Merge pull request #3817 from xcffl/master

Add explanation mounting named volumes for `podman run`

1 files changed, 54 insertions, 40 deletions

diff --git a/docs/podman-run.1.md b/docs/podman-run.1.md
index c642b50b6..8f46e8f22 100644
--- a/docs/podman-run.1.md
+++ b/docs/podman-run.1.md
@@ -282,7 +282,7 @@ on the host system.
 **--gidmap**=*container_gid:host_gid:amount*
 
 Run the container in a new user namespace using the supplied mapping. This option conflicts with the --userns and --subgidname flags.
-This option can be passed several times to map different ranges. If calling podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subuid(5)`.
+This option can be passed several times to map different ranges. If calling Podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subuid(5)`.
 The example maps gids 0-2000 in the container to the gids 30000-31999 on the host. `--gidmap=0:30000:2000`
 
 **--group-add**=*group*
@@ -329,7 +329,7 @@ Sets the container host name that is available inside the container.
 **--http-proxy**=*true|false*
 
 By default proxy environment variables are passed into the container if set
-for the podman process.  This can be disabled by setting the `--http-proxy`
+for the Podman process.  This can be disabled by setting the `--http-proxy`
 option to `false`.  The environment variables passed in include `http_proxy`,
 `https_proxy`, `ftp_proxy`, `no_proxy`, and also the upper case versions of
 those.  This option is only needed when the host system must use a proxy but
@@ -348,7 +348,7 @@ Defaults to `true`
 
 **--image-volume**, **builtin-volume**=*bind|tmpfs|ignore*
 
-Tells podman how to handle the builtin image volumes.
+Tells Podman how to handle the builtin image volumes.
 
 The options are: `bind`, `tmpfs`, or `ignore` (default `bind`)
 
@@ -475,6 +475,8 @@ Current supported mount TYPES are bind, and tmpfs.
 
        type=bind,source=/path/on/host,destination=/path/in/container
 
+       type=bind,source=volume-name,destination=/path/in/container
+
        type=tmpfs,tmpfs-size=512M,destination=/path/in/container
 
        Common Options:
@@ -516,7 +518,7 @@ Set the Network mode for the container. Invalid if using **--dns**, **--dns-opti
 - `bridge`: create a network stack on the default bridge
 - `none`: no networking
 - `container:<name|id>`: reuse another container's network stack
-- `host`: use the podman host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
+- `host`: use the Podman host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
 - `<network-name>|<network-id>`: connect to a user-defined network
 - `ns:<path>`: path to a network namespace to join
 - `slirp4netns`: use slirp4netns to create a user network stack.  This is the default for rootless containers
@@ -556,7 +558,7 @@ Tune the container's pids limit. Set `-1` to have unlimited pids for the contain
 
 **--pod**=*name*
 
-Run container in an existing pod. If you want podman to make the pod for you, preference the pod name with `new:`.
+Run container in an existing pod. If you want Podman to make the pod for you, preference the pod name with `new:`.
 To make a pod with more granular options, use the `podman pod create` command before creating a container.
 If a container is run with a pod, and the pod has an infra-container, the infra-container will be started before the container is.
 
@@ -564,12 +566,12 @@ If a container is run with a pod, and the pod has an infra-container, the infra-
 
 Give extended privileges to this container. The default is *false*.
 
-By default, podman containers are “unprivileged” (=false) and cannot,
+By default, Podman containers are “unprivileged” (=false) and cannot,
 for example, modify parts of the kernel. This is because by default a
 container is not allowed to access any devices. A “privileged” container
 is given access to all devices.
 
-When the operator executes **podman run --privileged**, podman enables access
+When the operator executes **podman run --privileged**, Podman enables access
 to all devices on the host, turns off graphdriver mount options, as well as
 turning off most of the security measures protecting the host from the
 container.
@@ -595,11 +597,11 @@ Use `podman port` to see the actual mapping: `podman port CONTAINER $CONTAINERPO
 Publish all exposed ports to random ports on the host interfaces. The default is *false*.
 
 When set to true publish all exposed ports to the host interfaces. The
-default is false. If the operator uses -P (or -p) then podman will make the
+default is false. If the operator uses -P (or -p) then Podman will make the
 exposed port accessible on the host and the ports will be available to any
 client that can reach the host.
 
-When using -P, podman will bind any exposed port to a random port on the host
+When using -P, Podman will bind any exposed port to a random port on the host
 within an *ephemeral port range* defined by `/proc/sys/net/ipv4/ip_local_port_range`.
 To find the mapping between the host ports and the exposed ports, use `podman port`.
 
@@ -702,13 +704,13 @@ Timeout (in seconds) to stop a container. Default is 10.
 **--subgidname**=*name*
 
 Run the container in a new user namespace using the map with 'name' in the `/etc/subgid` file.
-If calling podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subgid(5)`.
+If calling Podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subgid(5)`.
 This flag conflicts with `--userns` and `--gidmap`.
 
 **--subuidname**=*name*
 
 Run the container in a new user namespace using the map with 'name' in the `/etc/subuid` file.
-If calling podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subuid(5)`.
+If calling Podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subuid(5)`.
 This flag conflicts with `--userns` and `--uidmap`.
 
 **--sysctl**=SYSCTL
@@ -738,7 +740,7 @@ Note: if you use the `--network=host` option these sysctls will not be allowed.
 
 Run container in systemd mode. The default is *true*.
 
-If the command you are running inside of the container is systemd or init, podman
+If the command you are running inside of the container is systemd or init, Podman
 will setup tmpfs mount points in the following directories:
 
 /run, /run/lock, /tmp, /sys/fs/cgroup/systemd, /var/lib/journal
@@ -770,17 +772,17 @@ any options, the systems uses the following options:
 
 Allocate a pseudo-TTY. The default is *false*.
 
-When set to true podman will allocate a pseudo-tty and attach to the standard
+When set to true Podman will allocate a pseudo-tty and attach to the standard
 input of the container. This can be used, for example, to run a throwaway
 interactive shell. The default is false.
 
-**NOTE**: The **-t** option is incompatible with a redirection of the podman client
+**NOTE**: The **-t** option is incompatible with a redirection of the Podman client
 standard input.
 
 **--uidmap**=*container_uid:host_uid:amount*
 
 Run the container in a new user namespace using the supplied mapping. This option conflicts with the --userns and --subuidname flags.
-This option can be passed several times to map different ranges. If calling podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subuid(5)`.
+This option can be passed several times to map different ranges. If calling Podman run as an unprivileged user, the user needs to have the right to use the mapping. See `subuid(5)`.
 The example maps uids 0-2000 in the container to the uids 30000-31999 on the host. `--uidmap=0:30000:2000`
 
 **--ulimit**=*option*
@@ -821,19 +823,23 @@ Set the UTS mode for the container
 
 **NOTE**: the host mode gives the container access to changing the host's hostname and is therefore considered insecure.
 
-**--volume**, **-v**[=*[HOST-DIR:CONTAINER-DIR[:OPTIONS]]*]
+**--volume**, **-v**[=*[HOST-DIR-OR-VOUME-NAME:CONTAINER-DIR[:OPTIONS]]*]
+
+Create a bind mount. If you specify, ` -v /HOST-DIR:/CONTAINER-DIR`, Podman
+bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the Podman
+container. Similarly, `-v VOLUME-NAME:/CONTAINER-DIR` will mount the volume
+in the host to the container. If no such named volume exists, Podman will
+create one.
 
-Create a bind mount. If you specify, ` -v /HOST-DIR:/CONTAINER-DIR`, podman
-bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the podman
-container. The `OPTIONS` are a comma delimited list and can be:
+ The `OPTIONS` are a comma delimited list and can be:
 
 * [`rw`|`ro`]
 * [`z`|`Z`]
 * [`[r]shared`|`[r]slave`|`[r]private`]
 
-The `CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `HOST-DIR`
-must be an absolute path as well. podman bind-mounts the `HOST-DIR` to the
-path you specify. For example, if you supply the `/foo` value, podman creates a bind-mount.
+The `/CONTAINER-DIR` must be an absolute path such as `/src/docs`. The `/HOST-DIR`
+must be an absolute path as well. Podman bind-mounts the `HOST-DIR` to the
+path you specify. For example, if you supply the `/foo` value, Podman creates a bind-mount.
 
 You can specify multiple  **-v** options to mount one or more mounts to a
 container.
@@ -845,14 +851,14 @@ See examples.
 Labeling systems like SELinux require that proper labels are placed on volume
 content mounted into a container. Without a label, the security system might
 prevent the processes running inside the container from using the content. By
-default, podman does not change the labels set by the OS.
+default, Podman does not change the labels set by the OS.
 
 To change a label in the container context, you can add either of two suffixes
-`:z` or `:Z` to the volume mount. These suffixes tell podman to relabel file
-objects on the shared volumes. The `z` option tells podman that two containers
-share the volume content. As a result, podman labels the content with a shared
+`:z` or `:Z` to the volume mount. These suffixes tell Podman to relabel file
+objects on the shared volumes. The `z` option tells Podman that two containers
+share the volume content. As a result, Podman labels the content with a shared
 content label. Shared volume labels allow all containers to read/write content.
-The `Z` option tells podman to label the content with a private unshared label.
+The `Z` option tells Podman to label the content with a private unshared label.
 Only the current container can use a private volume.
 
 By default bind mounted volumes are `private`. That means any mounts done
@@ -900,7 +906,7 @@ To share a volume, use the --volumes-from option when running
 the target container. You can share volumes even if the source container
 is not running.
 
-By default, podman mounts the volumes in the same mode (read-write or
+By default, Podman mounts the volumes in the same mode (read-write or
 read-only) as it is mounted in the source container. Optionally, you
 can change this by suffixing the container-id with either the `ro` or
 `rw` keyword.
@@ -908,11 +914,11 @@ can change this by suffixing the container-id with either the `ro` or
 Labeling systems like SELinux require that proper labels are placed on volume
 content mounted into a container. Without a label, the security system might
 prevent the processes running inside the container from using the content. By
-default, podman does not change the labels set by the OS.
+default, Podman does not change the labels set by the OS.
 
 To change a label in the container context, you can add `z` to the volume mount.
-This suffix tells podman to relabel file objects on the shared volumes. The `z`
-option tells podman that two containers share the volume content. As a result,
+This suffix tells Podman to relabel file objects on the shared volumes. The `z`
+option tells Podman that two containers share the volume content. As a result,
 podman labels the content with a shared content label. Shared volume labels allow
 all containers to read/write content.
 
@@ -934,7 +940,7 @@ The exit code from `podman run` gives information about why the container
 failed to run or why it exited.  When `podman run` exits with a non-zero code,
 the exit codes follow the `chroot` standard, see below:
 
-**_125_** if the error is with podman **_itself_**
+**_125_** if the error is with Podman **_itself_**
 
     $ podman run --foo busybox; echo $?
     Error: unknown flag: --foo
@@ -1005,7 +1011,7 @@ This should list the message sent to logger.
 
 ### Attaching to one or more from STDIN, STDOUT, STDERR
 
-If you do not specify -a then podman will attach everything (stdin,stdout,stderr).
+If you do not specify -a then Podman will attach everything (stdin,stdout,stderr).
 You can specify to which of the three standard streams (stdin, stdout, stderr)
 you'd like to connect instead, as in:
 
@@ -1092,18 +1098,26 @@ $ podman run -p 8080:80 -d -i -t fedora/httpd
 
 To mount a host directory as a container volume, specify the absolute path to
 the directory and the absolute path for the container directory separated by a
-colon:
+colon. If the source is a named volume maintained by Podman, it's recommended to
+use it's name rather than the path to the volume. Otherwise the volume will be
+considered as an orphan and wiped if you execute `podman volume prune`:
 
 ```
 $ podman run -v /var/db:/data1 -i -t fedora bash
+
+$ podman run -v data:/data2 -i -t fedora bash
 ```
 
 Using --mount flags, To mount a host directory as a container folder, specify
-the absolute path to the directory and the absolute path for the container
-directory:
+the absolute path to the directory or the volume name, and the absolute path
+within the container directory:
 
+````
 $ podman run --mount type=bind,src=/var/db,target=/data1 busybox sh
 
+$ podman run --mount type=bind,src=volume-name,target=/data1 busybox sh
+````
+
 When using SELinux, be aware that the host has no knowledge of container SELinux
 policy. Therefore, in the above example, if SELinux policy is enforced, the
 `/var/db` directory is not writable to the container. A "Permission Denied"
@@ -1178,7 +1192,7 @@ $ podman run --sysctl net.ipv4.ip_forward=1 someimage
 
 Note:
 
-Not all sysctls are namespaced. podman does not support changing sysctls
+Not all sysctls are namespaced. Podman does not support changing sysctls
 inside of a container that also modify the host system. As the kernel
 evolves we expect to see more sysctls become namespaced.
 
@@ -1212,7 +1226,7 @@ Note: RHEL7 and Centos 7 will not have this feature until RHEL7.7 is released.
 
 In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace.
 
-Rootless podman works better if the fuse-overlayfs and slirp4netns packages are installed.
+Rootless Podman works better if the fuse-overlayfs and slirp4netns packages are installed.
 The fuse-overlay package provides a userspace overlay storage driver, otherwise users need to use
 the vfs storage driver, which is diskspace expensive and does not perform well. slirp4netns is
 required for VPN, without it containers need to be run with the --net=host flag.
@@ -1223,7 +1237,7 @@ Environment variables within containers can be set using multiple different opti
 
 Precedence Order:
 
-	   **--env-host** : Host environment of the process executing podman is added.
+	   **--env-host** : Host environment of the process executing Podman is added.
 
 	   Container image : Any environment variables specified in the container image.
 
@@ -1253,7 +1267,7 @@ subgid(5), subuid(5), libpod.conf(5), systemd.unit(5), setsebool(8), slirp4netns
 ## HISTORY
 September 2018, updated by Kunal Kushwaha <kushwaha_kunal_v7@lab.ntt.co.jp>
 
-October 2017, converted from Docker documentation to podman by Dan Walsh for podman <dwalsh@redhat.com>
+October 2017, converted from Docker documentation to Podman by Dan Walsh for Podman <dwalsh@redhat.com>
 
 November 2015, updated by Sally O'Malley <somalley@redhat.com>