summaryrefslogtreecommitdiff
path: root/docs/source/markdown/podman-build.1.md
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2020-02-27 14:19:07 -0400
committerDaniel J Walsh <dwalsh@redhat.com>2020-03-02 16:37:32 -0500
commitb163640c61dcb10953949a1ee28599d8a19fd046 (patch)
treee7b56307cc2778c6cab81f658515ea145d990979 /docs/source/markdown/podman-build.1.md
parent47c4ea39196cedac87e7a4e4c1ead54ed9d7ed50 (diff)
downloadpodman-b163640c61dcb10953949a1ee28599d8a19fd046.tar.gz
podman-b163640c61dcb10953949a1ee28599d8a19fd046.tar.bz2
podman-b163640c61dcb10953949a1ee28599d8a19fd046.zip
Allow devs to set labels in container images for default capabilities.
This patch allows users to specify the list of capabilities required to run their container image. Setting a image/container label "io.containers.capabilities=setuid,setgid" tells podman that the contained image should work fine with just these two capabilties, instead of running with the default capabilities, podman will launch the container with just these capabilties. If the user or image specified capabilities that are not in the default set, the container will print an error message and will continue to run with the default capabilities. Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
Diffstat (limited to 'docs/source/markdown/podman-build.1.md')
-rw-r--r--docs/source/markdown/podman-build.1.md10
1 files changed, 10 insertions, 0 deletions
diff --git a/docs/source/markdown/podman-build.1.md b/docs/source/markdown/podman-build.1.md
index 12f099e65..951d39e02 100644
--- a/docs/source/markdown/podman-build.1.md
+++ b/docs/source/markdown/podman-build.1.md
@@ -279,6 +279,16 @@ BUILDAH\_ISOLATION environment variable. `export BUILDAH_ISOLATION=oci`
Add an image *label* (e.g. label=*value*) to the image metadata. Can be used multiple times.
+Users can set a special LABEL **io.containers.capabilities=CAP1,CAP2,CAP3** in
+a Containerfile that specified the list of Linux capabilities required for the
+container to run properly. This label specified in a container image tells
+Podman to run the container with just these capabilties. Podman launches the
+container with just the specified capabilties, as long as this list of
+capabilities is a subset of the default list.
+
+If the specified capabilities are not in the default set, the container will
+print an error message and will run the container with the default capabilities.
+
**--layers**
Cache intermediate images during the build process (Default is `true`).