Merge pull request #11102 from cdoern/infraEnhance

InfraContainer Rework

5 files changed, 1964 insertions, 0 deletions

diff --git a/pkg/specgenutil/createparse.go b/pkg/specgenutil/createparse.go
new file mode 100644
index 000000000..b46d8fbc6
--- /dev/null
+++ b/pkg/specgenutil/createparse.go
@@ -0,0 +1,34 @@
+package specgenutil
+
+import (
+	"github.com/containers/common/pkg/config"
+	"github.com/containers/podman/v3/pkg/domain/entities"
+	"github.com/pkg/errors"
+)
+
+// validate determines if the flags and values given by the user are valid. things checked
+// by validate must not need any state information on the flag (i.e. changed)
+func validate(c *entities.ContainerCreateOptions) error {
+	var ()
+	if c.Rm && (c.Restart != "" && c.Restart != "no" && c.Restart != "on-failure") {
+		return errors.Errorf(`the --rm option conflicts with --restart, when the restartPolicy is not "" and "no"`)
+	}
+
+	if _, err := config.ParsePullPolicy(c.Pull); err != nil {
+		return err
+	}
+
+	var imageVolType = map[string]string{
+		"bind":   "",
+		"tmpfs":  "",
+		"ignore": "",
+	}
+	if _, ok := imageVolType[c.ImageVolume]; !ok {
+		if c.IsInfra {
+			c.ImageVolume = "bind"
+		} else {
+			return errors.Errorf("invalid image-volume type %q. Pick one of bind, tmpfs, or ignore", c.ImageVolume)
+		}
+	}
+	return nil
+}
diff --git a/pkg/specgenutil/ports.go b/pkg/specgenutil/ports.go
new file mode 100644
index 000000000..6cc4de1ed
--- /dev/null
+++ b/pkg/specgenutil/ports.go
@@ -0,0 +1,22 @@
+package specgenutil
+
+import (
+	"github.com/docker/go-connections/nat"
+	"github.com/pkg/errors"
+)
+
+func verifyExpose(expose []string) error {
+	// add the expose ports from the user (--expose)
+	// can be single or a range
+	for _, expose := range expose {
+		// support two formats for expose, original format <portnum>/[<proto>] or <startport-endport>/[<proto>]
+		_, port := nat.SplitProtoPort(expose)
+		// parse the start and end port and create a sequence of ports to expose
+		// if expose a port, the start and end port are the same
+		_, _, err := nat.ParsePortRange(port)
+		if err != nil {
+			return errors.Wrapf(err, "invalid range format for --expose: %s", expose)
+		}
+	}
+	return nil
+}
diff --git a/pkg/specgenutil/specgen.go b/pkg/specgenutil/specgen.go
new file mode 100644
index 000000000..9f676db1b
--- /dev/null
+++ b/pkg/specgenutil/specgen.go
@@ -0,0 +1,1004 @@
+package specgenutil
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"strconv"
+	"strings"
+	"time"
+
+	"github.com/containers/image/v5/manifest"
+	"github.com/containers/podman/v3/cmd/podman/parse"
+	"github.com/containers/podman/v3/libpod/define"
+	ann "github.com/containers/podman/v3/pkg/annotations"
+	"github.com/containers/podman/v3/pkg/domain/entities"
+	envLib "github.com/containers/podman/v3/pkg/env"
+	"github.com/containers/podman/v3/pkg/namespaces"
+	"github.com/containers/podman/v3/pkg/specgen"
+	systemdDefine "github.com/containers/podman/v3/pkg/systemd/define"
+	"github.com/containers/podman/v3/pkg/util"
+	"github.com/docker/go-units"
+	"github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/pkg/errors"
+)
+
+func getCPULimits(c *entities.ContainerCreateOptions) *specs.LinuxCPU {
+	cpu := &specs.LinuxCPU{}
+	hasLimits := false
+
+	if c.CPUS > 0 {
+		period, quota := util.CoresToPeriodAndQuota(c.CPUS)
+
+		cpu.Period = &period
+		cpu.Quota = &quota
+		hasLimits = true
+	}
+	if c.CPUShares > 0 {
+		cpu.Shares = &c.CPUShares
+		hasLimits = true
+	}
+	if c.CPUPeriod > 0 {
+		cpu.Period = &c.CPUPeriod
+		hasLimits = true
+	}
+	if c.CPUSetCPUs != "" {
+		cpu.Cpus = c.CPUSetCPUs
+		hasLimits = true
+	}
+	if c.CPUSetMems != "" {
+		cpu.Mems = c.CPUSetMems
+		hasLimits = true
+	}
+	if c.CPUQuota > 0 {
+		cpu.Quota = &c.CPUQuota
+		hasLimits = true
+	}
+	if c.CPURTPeriod > 0 {
+		cpu.RealtimePeriod = &c.CPURTPeriod
+		hasLimits = true
+	}
+	if c.CPURTRuntime > 0 {
+		cpu.RealtimeRuntime = &c.CPURTRuntime
+		hasLimits = true
+	}
+
+	if !hasLimits {
+		return nil
+	}
+	return cpu
+}
+
+func getIOLimits(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions) (*specs.LinuxBlockIO, error) {
+	var err error
+	io := &specs.LinuxBlockIO{}
+	hasLimits := false
+	if b := c.BlkIOWeight; len(b) > 0 {
+		u, err := strconv.ParseUint(b, 10, 16)
+		if err != nil {
+			return nil, errors.Wrapf(err, "invalid value for blkio-weight")
+		}
+		nu := uint16(u)
+		io.Weight = &nu
+		hasLimits = true
+	}
+
+	if len(c.BlkIOWeightDevice) > 0 {
+		if err := parseWeightDevices(s, c.BlkIOWeightDevice); err != nil {
+			return nil, err
+		}
+		hasLimits = true
+	}
+
+	if bps := c.DeviceReadBPs; len(bps) > 0 {
+		if s.ThrottleReadBpsDevice, err = parseThrottleBPSDevices(bps); err != nil {
+			return nil, err
+		}
+		hasLimits = true
+	}
+
+	if bps := c.DeviceWriteBPs; len(bps) > 0 {
+		if s.ThrottleWriteBpsDevice, err = parseThrottleBPSDevices(bps); err != nil {
+			return nil, err
+		}
+		hasLimits = true
+	}
+
+	if iops := c.DeviceReadIOPs; len(iops) > 0 {
+		if s.ThrottleReadIOPSDevice, err = parseThrottleIOPsDevices(iops); err != nil {
+			return nil, err
+		}
+		hasLimits = true
+	}
+
+	if iops := c.DeviceWriteIOPs; len(iops) > 0 {
+		if s.ThrottleWriteIOPSDevice, err = parseThrottleIOPsDevices(iops); err != nil {
+			return nil, err
+		}
+		hasLimits = true
+	}
+
+	if !hasLimits {
+		return nil, nil
+	}
+	return io, nil
+}
+
+func getMemoryLimits(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions) (*specs.LinuxMemory, error) {
+	var err error
+	memory := &specs.LinuxMemory{}
+	hasLimits := false
+	if m := c.Memory; len(m) > 0 {
+		ml, err := units.RAMInBytes(m)
+		if err != nil {
+			return nil, errors.Wrapf(err, "invalid value for memory")
+		}
+		memory.Limit = &ml
+		if c.MemorySwap == "" {
+			limit := 2 * ml
+			memory.Swap = &(limit)
+		}
+		hasLimits = true
+	}
+	if m := c.MemoryReservation; len(m) > 0 {
+		mr, err := units.RAMInBytes(m)
+		if err != nil {
+			return nil, errors.Wrapf(err, "invalid value for memory")
+		}
+		memory.Reservation = &mr
+		hasLimits = true
+	}
+	if m := c.MemorySwap; len(m) > 0 {
+		var ms int64
+		// only set memory swap if it was set
+		// -1 indicates unlimited
+		if m != "-1" {
+			ms, err = units.RAMInBytes(m)
+			memory.Swap = &ms
+			if err != nil {
+				return nil, errors.Wrapf(err, "invalid value for memory")
+			}
+			hasLimits = true
+		}
+	}
+	if m := c.KernelMemory; len(m) > 0 {
+		mk, err := units.RAMInBytes(m)
+		if err != nil {
+			return nil, errors.Wrapf(err, "invalid value for kernel-memory")
+		}
+		memory.Kernel = &mk
+		hasLimits = true
+	}
+	if c.MemorySwappiness > 0 {
+		swappiness := uint64(c.MemorySwappiness)
+		memory.Swappiness = &swappiness
+		hasLimits = true
+	}
+	if c.OOMKillDisable {
+		memory.DisableOOMKiller = &c.OOMKillDisable
+		hasLimits = true
+	}
+	if !hasLimits {
+		return nil, nil
+	}
+	return memory, nil
+}
+
+func setNamespaces(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions) error {
+	var err error
+
+	if c.PID != "" {
+		s.PidNS, err = specgen.ParseNamespace(c.PID)
+		if err != nil {
+			return err
+		}
+	}
+	if c.IPC != "" {
+		s.IpcNS, err = specgen.ParseNamespace(c.IPC)
+		if err != nil {
+			return err
+		}
+	}
+	if c.UTS != "" {
+		s.UtsNS, err = specgen.ParseNamespace(c.UTS)
+		if err != nil {
+			return err
+		}
+	}
+	if c.CgroupNS != "" {
+		s.CgroupNS, err = specgen.ParseNamespace(c.CgroupNS)
+		if err != nil {
+			return err
+		}
+	}
+	// userns must be treated differently
+	if c.UserNS != "" {
+		s.UserNS, err = specgen.ParseUserNamespace(c.UserNS)
+		if err != nil {
+			return err
+		}
+	}
+	if c.Net != nil {
+		s.NetNS = c.Net.Network
+	}
+	return nil
+}
+
+func FillOutSpecGen(s *specgen.SpecGenerator, c *entities.ContainerCreateOptions, args []string) error {
+	var (
+		err error
+	)
+	// validate flags as needed
+	if err := validate(c); err != nil {
+		return err
+	}
+	s.User = c.User
+	var inputCommand []string
+	if !c.IsInfra {
+		if len(args) > 1 {
+			inputCommand = args[1:]
+		}
+	}
+
+	if len(c.HealthCmd) > 0 {
+		if c.NoHealthCheck {
+			return errors.New("Cannot specify both --no-healthcheck and --health-cmd")
+		}
+		s.HealthConfig, err = makeHealthCheckFromCli(c.HealthCmd, c.HealthInterval, c.HealthRetries, c.HealthTimeout, c.HealthStartPeriod)
+		if err != nil {
+			return err
+		}
+	} else if c.NoHealthCheck {
+		s.HealthConfig = &manifest.Schema2HealthConfig{
+			Test: []string{"NONE"},
+		}
+	}
+	if err := setNamespaces(s, c); err != nil {
+		return err
+	}
+	userNS := namespaces.UsernsMode(s.UserNS.NSMode)
+	tempIDMap, err := util.ParseIDMapping(namespaces.UsernsMode(c.UserNS), []string{}, []string{}, "", "")
+	if err != nil {
+		return err
+	}
+	s.IDMappings, err = util.ParseIDMapping(userNS, c.UIDMap, c.GIDMap, c.SubUIDName, c.SubGIDName)
+	if err != nil {
+		return err
+	}
+	if len(s.IDMappings.GIDMap) == 0 {
+		s.IDMappings.AutoUserNsOpts.AdditionalGIDMappings = tempIDMap.AutoUserNsOpts.AdditionalGIDMappings
+		if s.UserNS.NSMode == specgen.NamespaceMode("auto") {
+			s.IDMappings.AutoUserNs = true
+		}
+	}
+	if len(s.IDMappings.UIDMap) == 0 {
+		s.IDMappings.AutoUserNsOpts.AdditionalUIDMappings = tempIDMap.AutoUserNsOpts.AdditionalUIDMappings
+		if s.UserNS.NSMode == specgen.NamespaceMode("auto") {
+			s.IDMappings.AutoUserNs = true
+		}
+	}
+	if tempIDMap.AutoUserNsOpts.Size != 0 {
+		s.IDMappings.AutoUserNsOpts.Size = tempIDMap.AutoUserNsOpts.Size
+	}
+	// If some mappings are specified, assume a private user namespace
+	if userNS.IsDefaultValue() && (!s.IDMappings.HostUIDMapping || !s.IDMappings.HostGIDMapping) {
+		s.UserNS.NSMode = specgen.Private
+	} else {
+		s.UserNS.NSMode = specgen.NamespaceMode(userNS)
+	}
+
+	s.Terminal = c.TTY
+
+	if err := verifyExpose(c.Expose); err != nil {
+		return err
+	}
+	// We are not handling the Expose flag yet.
+	// s.PortsExpose = c.Expose
+	if c.Net != nil {
+		s.PortMappings = c.Net.PublishPorts
+	}
+	s.PublishExposedPorts = c.PublishAll
+	s.Pod = c.Pod
+
+	if len(c.PodIDFile) > 0 {
+		if len(s.Pod) > 0 {
+			return errors.New("Cannot specify both --pod and --pod-id-file")
+		}
+		podID, err := ReadPodIDFile(c.PodIDFile)
+		if err != nil {
+			return err
+		}
+		s.Pod = podID
+	}
+
+	expose, err := createExpose(c.Expose)
+	if err != nil {
+		return err
+	}
+	s.Expose = expose
+
+	if sig := c.StopSignal; len(sig) > 0 {
+		stopSignal, err := util.ParseSignal(sig)
+		if err != nil {
+			return err
+		}
+		s.StopSignal = &stopSignal
+	}
+
+	// ENVIRONMENT VARIABLES
+	//
+	// Precedence order (higher index wins):
+	//  1) containers.conf (EnvHost, EnvHTTP, Env) 2) image data, 3 User EnvHost/EnvHTTP, 4) env-file, 5) env
+	// containers.conf handled and image data handled on the server side
+	// user specified EnvHost and EnvHTTP handled on Server Side relative to Server
+	// env-file and env handled on client side
+	var env map[string]string
+
+	// First transform the os env into a map. We need it for the labels later in
+	// any case.
+	osEnv, err := envLib.ParseSlice(os.Environ())
+	if err != nil {
+		return errors.Wrap(err, "error parsing host environment variables")
+	}
+
+	s.EnvHost = c.EnvHost
+	s.HTTPProxy = c.HTTPProxy
+
+	// env-file overrides any previous variables
+	for _, f := range c.EnvFile {
+		fileEnv, err := envLib.ParseFile(f)
+		if err != nil {
+			return err
+		}
+		// File env is overridden by env.
+		env = envLib.Join(env, fileEnv)
+	}
+
+	parsedEnv, err := envLib.ParseSlice(c.Env)
+	if err != nil {
+		return err
+	}
+
+	s.Env = envLib.Join(env, parsedEnv)
+
+	// LABEL VARIABLES
+	labels, err := parse.GetAllLabels(c.LabelFile, c.Label)
+	if err != nil {
+		return errors.Wrapf(err, "unable to process labels")
+	}
+
+	if systemdUnit, exists := osEnv[systemdDefine.EnvVariable]; exists {
+		labels[systemdDefine.EnvVariable] = systemdUnit
+	}
+
+	s.Labels = labels
+
+	// ANNOTATIONS
+	annotations := make(map[string]string)
+
+	// First, add our default annotations
+	annotations[ann.TTY] = "false"
+	if c.TTY {
+		annotations[ann.TTY] = "true"
+	}
+
+	// Last, add user annotations
+	for _, annotation := range c.Annotation {
+		splitAnnotation := strings.SplitN(annotation, "=", 2)
+		if len(splitAnnotation) < 2 {
+			return errors.Errorf("Annotations must be formatted KEY=VALUE")
+		}
+		annotations[splitAnnotation[0]] = splitAnnotation[1]
+	}
+	s.Annotations = annotations
+
+	s.WorkDir = c.Workdir
+	if c.Entrypoint != nil {
+		entrypoint := []string{}
+		if ep := *c.Entrypoint; len(ep) > 0 {
+			// Check if entrypoint specified is json
+			if err := json.Unmarshal([]byte(*c.Entrypoint), &entrypoint); err != nil {
+				entrypoint = append(entrypoint, ep)
+			}
+		}
+		s.Entrypoint = entrypoint
+	}
+
+	// Include the command used to create the container.
+
+	s.ContainerCreateCommand = os.Args
+
+	if len(inputCommand) > 0 {
+		s.Command = inputCommand
+	}
+
+	// SHM Size
+	if c.ShmSize != "" {
+		shmSize, err := units.FromHumanSize(c.ShmSize)
+		if err != nil {
+			return errors.Wrapf(err, "unable to translate --shm-size")
+		}
+		s.ShmSize = &shmSize
+	}
+
+	if c.Net != nil {
+		s.CNINetworks = c.Net.CNINetworks
+	}
+
+	// Network aliases
+	if c.Net != nil {
+		if len(c.Net.Aliases) > 0 {
+			// build a map of aliases where key=cniName
+			aliases := make(map[string][]string, len(s.CNINetworks))
+			for _, cniNetwork := range s.CNINetworks {
+				aliases[cniNetwork] = c.Net.Aliases
+			}
+			s.Aliases = aliases
+		}
+	}
+
+	if c.Net != nil {
+		s.HostAdd = c.Net.AddHosts
+		s.UseImageResolvConf = c.Net.UseImageResolvConf
+		s.DNSServers = c.Net.DNSServers
+		s.DNSSearch = c.Net.DNSSearch
+		s.DNSOptions = c.Net.DNSOptions
+		s.StaticIP = c.Net.StaticIP
+		s.StaticMAC = c.Net.StaticMAC
+		s.NetworkOptions = c.Net.NetworkOptions
+		s.UseImageHosts = c.Net.NoHosts
+	}
+	s.ImageVolumeMode = c.ImageVolume
+	if s.ImageVolumeMode == "bind" {
+		s.ImageVolumeMode = "anonymous"
+	}
+
+	s.Systemd = c.Systemd
+	s.SdNotifyMode = c.SdNotifyMode
+	if s.ResourceLimits == nil {
+		s.ResourceLimits = &specs.LinuxResources{}
+	}
+	s.ResourceLimits.Memory, err = getMemoryLimits(s, c)
+	if err != nil {
+		return err
+	}
+	s.ResourceLimits.BlockIO, err = getIOLimits(s, c)
+	if err != nil {
+		return err
+	}
+	if c.PIDsLimit != nil {
+		pids := specs.LinuxPids{
+			Limit: *c.PIDsLimit,
+		}
+
+		s.ResourceLimits.Pids = &pids
+	}
+	s.ResourceLimits.CPU = getCPULimits(c)
+
+	unifieds := make(map[string]string)
+	for _, unified := range c.CgroupConf {
+		splitUnified := strings.SplitN(unified, "=", 2)
+		if len(splitUnified) < 2 {
+			return errors.Errorf("--cgroup-conf must be formatted KEY=VALUE")
+		}
+		unifieds[splitUnified[0]] = splitUnified[1]
+	}
+	if len(unifieds) > 0 {
+		s.ResourceLimits.Unified = unifieds
+	}
+
+	if s.ResourceLimits.CPU == nil && s.ResourceLimits.Pids == nil && s.ResourceLimits.BlockIO == nil && s.ResourceLimits.Memory == nil && s.ResourceLimits.Unified == nil {
+		s.ResourceLimits = nil
+	}
+
+	if s.LogConfiguration == nil {
+		s.LogConfiguration = &specgen.LogConfig{}
+	}
+
+	if ld := c.LogDriver; len(ld) > 0 {
+		s.LogConfiguration.Driver = ld
+	}
+	s.CgroupParent = c.CGroupParent
+	s.CgroupsMode = c.CGroupsMode
+	s.Groups = c.GroupAdd
+
+	s.Hostname = c.Hostname
+	sysctl := map[string]string{}
+	if ctl := c.Sysctl; len(ctl) > 0 {
+		sysctl, err = util.ValidateSysctls(ctl)
+		if err != nil {
+			return err
+		}
+	}
+	s.Sysctl = sysctl
+
+	s.CapAdd = c.CapAdd
+	s.CapDrop = c.CapDrop
+	s.Privileged = c.Privileged
+	s.ReadOnlyFilesystem = c.ReadOnly
+	s.ConmonPidFile = c.ConmonPIDFile
+
+	s.DependencyContainers = c.Requires
+
+	// TODO
+	// outside of specgen and oci though
+	// defaults to true, check spec/storage
+	// s.readonly = c.ReadOnlyTmpFS
+	//  TODO convert to map?
+	// check if key=value and convert
+	sysmap := make(map[string]string)
+	for _, ctl := range c.Sysctl {
+		splitCtl := strings.SplitN(ctl, "=", 2)
+		if len(splitCtl) < 2 {
+			return errors.Errorf("invalid sysctl value %q", ctl)
+		}
+		sysmap[splitCtl[0]] = splitCtl[1]
+	}
+	s.Sysctl = sysmap
+
+	if c.CIDFile != "" {
+		s.Annotations[define.InspectAnnotationCIDFile] = c.CIDFile
+	}
+
+	for _, opt := range c.SecurityOpt {
+		if opt == "no-new-privileges" {
+			s.ContainerSecurityConfig.NoNewPrivileges = true
+		} else {
+			con := strings.SplitN(opt, "=", 2)
+			if len(con) != 2 {
+				return fmt.Errorf("invalid --security-opt 1: %q", opt)
+			}
+			switch con[0] {
+			case "apparmor":
+				s.ContainerSecurityConfig.ApparmorProfile = con[1]
+				s.Annotations[define.InspectAnnotationApparmor] = con[1]
+			case "label":
+				// TODO selinux opts and label opts are the same thing
+				s.ContainerSecurityConfig.SelinuxOpts = append(s.ContainerSecurityConfig.SelinuxOpts, con[1])
+				s.Annotations[define.InspectAnnotationLabel] = strings.Join(s.ContainerSecurityConfig.SelinuxOpts, ",label=")
+			case "mask":
+				s.ContainerSecurityConfig.Mask = append(s.ContainerSecurityConfig.Mask, strings.Split(con[1], ":")...)
+			case "proc-opts":
+				s.ProcOpts = strings.Split(con[1], ",")
+			case "seccomp":
+				s.SeccompProfilePath = con[1]
+				s.Annotations[define.InspectAnnotationSeccomp] = con[1]
+			// this option is for docker compatibility, it is the same as unmask=ALL
+			case "systempaths":
+				if con[1] == "unconfined" {
+					s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, []string{"ALL"}...)
+				} else {
+					return fmt.Errorf("invalid systempaths option %q, only `unconfined` is supported", con[1])
+				}
+			case "unmask":
+				s.ContainerSecurityConfig.Unmask = append(s.ContainerSecurityConfig.Unmask, con[1:]...)
+			default:
+				return fmt.Errorf("invalid --security-opt 2: %q", opt)
+			}
+		}
+	}
+
+	s.SeccompPolicy = c.SeccompPolicy
+
+	s.VolumesFrom = c.VolumesFrom
+
+	// Only add read-only tmpfs mounts in case that we are read-only and the
+	// read-only tmpfs flag has been set.
+	mounts, volumes, overlayVolumes, imageVolumes, err := parseVolumes(c.Volume, c.Mount, c.TmpFS, c.ReadOnlyTmpFS && c.ReadOnly)
+	if err != nil {
+		return err
+	}
+	s.Mounts = mounts
+	s.Volumes = volumes
+	s.OverlayVolumes = overlayVolumes
+	s.ImageVolumes = imageVolumes
+
+	for _, dev := range c.Devices {
+		s.Devices = append(s.Devices, specs.LinuxDevice{Path: dev})
+	}
+
+	for _, rule := range c.DeviceCGroupRule {
+		dev, err := parseLinuxResourcesDeviceAccess(rule)
+		if err != nil {
+			return err
+		}
+		s.DeviceCGroupRule = append(s.DeviceCGroupRule, dev)
+	}
+
+	s.Init = c.Init
+	s.InitPath = c.InitPath
+	s.Stdin = c.Interactive
+	// quiet
+	// DeviceCgroupRules: c.StringSlice("device-cgroup-rule"),
+
+	// Rlimits/Ulimits
+	for _, u := range c.Ulimit {
+		if u == "host" {
+			s.Rlimits = nil
+			break
+		}
+		ul, err := units.ParseUlimit(u)
+		if err != nil {
+			return errors.Wrapf(err, "ulimit option %q requires name=SOFT:HARD, failed to be parsed", u)
+		}
+		rl := specs.POSIXRlimit{
+			Type: ul.Name,
+			Hard: uint64(ul.Hard),
+			Soft: uint64(ul.Soft),
+		}
+		s.Rlimits = append(s.Rlimits, rl)
+	}
+
+	logOpts := make(map[string]string)
+	for _, o := range c.LogOptions {
+		split := strings.SplitN(o, "=", 2)
+		if len(split) < 2 {
+			return errors.Errorf("invalid log option %q", o)
+		}
+		switch strings.ToLower(split[0]) {
+		case "driver":
+			s.LogConfiguration.Driver = split[1]
+		case "path":
+			s.LogConfiguration.Path = split[1]
+		case "max-size":
+			logSize, err := units.FromHumanSize(split[1])
+			if err != nil {
+				return err
+			}
+			s.LogConfiguration.Size = logSize
+		default:
+			logOpts[split[0]] = split[1]
+		}
+	}
+	s.LogConfiguration.Options = logOpts
+	s.Name = c.Name
+	s.PreserveFDs = c.PreserveFDs
+
+	s.OOMScoreAdj = &c.OOMScoreAdj
+	if c.Restart != "" {
+		splitRestart := strings.Split(c.Restart, ":")
+		switch len(splitRestart) {
+		case 1:
+			// No retries specified
+		case 2:
+			if strings.ToLower(splitRestart[0]) != "on-failure" {
+				return errors.Errorf("restart policy retries can only be specified with on-failure restart policy")
+			}
+			retries, err := strconv.Atoi(splitRestart[1])
+			if err != nil {
+				return errors.Wrapf(err, "error parsing restart policy retry count")
+			}
+			if retries < 0 {
+				return errors.Errorf("must specify restart policy retry count as a number greater than 0")
+			}
+			var retriesUint = uint(retries)
+			s.RestartRetries = &retriesUint
+		default:
+			return errors.Errorf("invalid restart policy: may specify retries at most once")
+		}
+		s.RestartPolicy = splitRestart[0]
+	}
+
+	s.Secrets, s.EnvSecrets, err = parseSecrets(c.Secrets)
+	if err != nil {
+		return err
+	}
+
+	if c.Personality != "" {
+		s.Personality = &specs.LinuxPersonality{}
+		s.Personality.Domain = specs.LinuxPersonalityDomain(c.Personality)
+	}
+
+	s.Remove = c.Rm
+	s.StopTimeout = &c.StopTimeout
+	s.Timeout = c.Timeout
+	s.Timezone = c.Timezone
+	s.Umask = c.Umask
+	s.PidFile = c.PidFile
+	s.Volatile = c.Rm
+
+	// Initcontainers
+	s.InitContainerType = c.InitContainerType
+	return nil
+}
+
+func makeHealthCheckFromCli(inCmd, interval string, retries uint, timeout, startPeriod string) (*manifest.Schema2HealthConfig, error) {
+	cmdArr := []string{}
+	isArr := true
+	err := json.Unmarshal([]byte(inCmd), &cmdArr) // array unmarshalling
+	if err != nil {
+		cmdArr = strings.SplitN(inCmd, " ", 2) // default for compat
+		isArr = false
+	}
+	// Every healthcheck requires a command
+	if len(cmdArr) == 0 {
+		return nil, errors.New("Must define a healthcheck command for all healthchecks")
+	}
+	concat := ""
+	if cmdArr[0] == "CMD" || cmdArr[0] == "none" { // this is for compat, we are already split properly for most compat cases
+		cmdArr = strings.Fields(inCmd)
+	} else if cmdArr[0] != "CMD-SHELL" { // this is for podman side of things, won't contain the keywords
+		if isArr && len(cmdArr) > 1 { // an array of consecutive commands
+			cmdArr = append([]string{"CMD"}, cmdArr...)
+		} else { // one singular command
+			if len(cmdArr) == 1 {
+				concat = cmdArr[0]
+			} else {
+				concat = strings.Join(cmdArr[0:], " ")
+			}
+			cmdArr = append([]string{"CMD-SHELL"}, concat)
+		}
+	}
+
+	if cmdArr[0] == "none" { // if specified to remove healtcheck
+		cmdArr = []string{"NONE"}
+	}
+
+	// healthcheck is by default an array, so we simply pass the user input
+	hc := manifest.Schema2HealthConfig{
+		Test: cmdArr,
+	}
+
+	if interval == "disable" {
+		interval = "0"
+	}
+	intervalDuration, err := time.ParseDuration(interval)
+	if err != nil {
+		return nil, errors.Wrapf(err, "invalid healthcheck-interval")
+	}
+
+	hc.Interval = intervalDuration
+
+	if retries < 1 {
+		return nil, errors.New("healthcheck-retries must be greater than 0")
+	}
+	hc.Retries = int(retries)
+	timeoutDuration, err := time.ParseDuration(timeout)
+	if err != nil {
+		return nil, errors.Wrapf(err, "invalid healthcheck-timeout")
+	}
+	if timeoutDuration < time.Duration(1) {
+		return nil, errors.New("healthcheck-timeout must be at least 1 second")
+	}
+	hc.Timeout = timeoutDuration
+
+	startPeriodDuration, err := time.ParseDuration(startPeriod)
+	if err != nil {
+		return nil, errors.Wrapf(err, "invalid healthcheck-start-period")
+	}
+	if startPeriodDuration < time.Duration(0) {
+		return nil, errors.New("healthcheck-start-period must be 0 seconds or greater")
+	}
+	hc.StartPeriod = startPeriodDuration
+
+	return &hc, nil
+}
+
+func parseWeightDevices(s *specgen.SpecGenerator, weightDevs []string) error {
+	for _, val := range weightDevs {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return fmt.Errorf("bad format: %s", val)
+		}
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return fmt.Errorf("bad format for device path: %s", val)
+		}
+		weight, err := strconv.ParseUint(split[1], 10, 0)
+		if err != nil {
+			return fmt.Errorf("invalid weight for device: %s", val)
+		}
+		if weight > 0 && (weight < 10 || weight > 1000) {
+			return fmt.Errorf("invalid weight for device: %s", val)
+		}
+		w := uint16(weight)
+		s.WeightDevice[split[0]] = specs.LinuxWeightDevice{
+			Weight:     &w,
+			LeafWeight: nil,
+		}
+	}
+	return nil
+}
+
+func parseThrottleBPSDevices(bpsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
+	td := make(map[string]specs.LinuxThrottleDevice)
+	for _, val := range bpsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
+		}
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
+		}
+		rate, err := units.RAMInBytes(split[1])
+		if err != nil {
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
+		}
+		if rate < 0 {
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>[<unit>]. Number must be a positive integer. Unit is optional and can be kb, mb, or gb", val)
+		}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: uint64(rate)}
+	}
+	return td, nil
+}
+
+func parseThrottleIOPsDevices(iopsDevices []string) (map[string]specs.LinuxThrottleDevice, error) {
+	td := make(map[string]specs.LinuxThrottleDevice)
+	for _, val := range iopsDevices {
+		split := strings.SplitN(val, ":", 2)
+		if len(split) != 2 {
+			return nil, fmt.Errorf("bad format: %s", val)
+		}
+		if !strings.HasPrefix(split[0], "/dev/") {
+			return nil, fmt.Errorf("bad format for device path: %s", val)
+		}
+		rate, err := strconv.ParseUint(split[1], 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("invalid rate for device: %s. The correct format is <device-path>:<number>. Number must be a positive integer", val)
+		}
+		td[split[0]] = specs.LinuxThrottleDevice{Rate: rate}
+	}
+	return td, nil
+}
+
+func parseSecrets(secrets []string) ([]specgen.Secret, map[string]string, error) {
+	secretParseError := errors.New("error parsing secret")
+	var mount []specgen.Secret
+	envs := make(map[string]string)
+	for _, val := range secrets {
+		// mount only tells if user has set an option that can only be used with mount secret type
+		mountOnly := false
+		source := ""
+		secretType := ""
+		target := ""
+		var uid, gid uint32
+		// default mode 444 octal = 292 decimal
+		var mode uint32 = 292
+		split := strings.Split(val, ",")
+
+		// --secret mysecret
+		if len(split) == 1 {
+			mountSecret := specgen.Secret{
+				Source: val,
+				UID:    uid,
+				GID:    gid,
+				Mode:   mode,
+			}
+			mount = append(mount, mountSecret)
+			continue
+		}
+		// --secret mysecret,opt=opt
+		if !strings.Contains(split[0], "=") {
+			source = split[0]
+			split = split[1:]
+		}
+
+		for _, val := range split {
+			kv := strings.SplitN(val, "=", 2)
+			if len(kv) < 2 {
+				return nil, nil, errors.Wrapf(secretParseError, "option %s must be in form option=value", val)
+			}
+			switch kv[0] {
+			case "source":
+				source = kv[1]
+			case "type":
+				if secretType != "" {
+					return nil, nil, errors.Wrap(secretParseError, "cannot set more tha one secret type")
+				}
+				if kv[1] != "mount" && kv[1] != "env" {
+					return nil, nil, errors.Wrapf(secretParseError, "type %s is invalid", kv[1])
+				}
+				secretType = kv[1]
+			case "target":
+				target = kv[1]
+			case "mode":
+				mountOnly = true
+				mode64, err := strconv.ParseUint(kv[1], 8, 32)
+				if err != nil {
+					return nil, nil, errors.Wrapf(secretParseError, "mode %s invalid", kv[1])
+				}
+				mode = uint32(mode64)
+			case "uid", "UID":
+				mountOnly = true
+				uid64, err := strconv.ParseUint(kv[1], 10, 32)
+				if err != nil {
+					return nil, nil, errors.Wrapf(secretParseError, "UID %s invalid", kv[1])
+				}
+				uid = uint32(uid64)
+			case "gid", "GID":
+				mountOnly = true
+				gid64, err := strconv.ParseUint(kv[1], 10, 32)
+				if err != nil {
+					return nil, nil, errors.Wrapf(secretParseError, "GID %s invalid", kv[1])
+				}
+				gid = uint32(gid64)
+
+			default:
+				return nil, nil, errors.Wrapf(secretParseError, "option %s invalid", val)
+			}
+		}
+
+		if secretType == "" {
+			secretType = "mount"
+		}
+		if source == "" {
+			return nil, nil, errors.Wrapf(secretParseError, "no source found %s", val)
+		}
+		if secretType == "mount" {
+			if target != "" {
+				return nil, nil, errors.Wrapf(secretParseError, "target option is invalid for mounted secrets")
+			}
+			mountSecret := specgen.Secret{
+				Source: source,
+				UID:    uid,
+				GID:    gid,
+				Mode:   mode,
+			}
+			mount = append(mount, mountSecret)
+		}
+		if secretType == "env" {
+			if mountOnly {
+				return nil, nil, errors.Wrap(secretParseError, "UID, GID, Mode options cannot be set with secret type env")
+			}
+			if target == "" {
+				target = source
+			}
+			envs[target] = source
+		}
+	}
+	return mount, envs, nil
+}
+
+var cgroupDeviceType = map[string]bool{
+	"a": true, // all
+	"b": true, // block device
+	"c": true, // character device
+}
+
+var cgroupDeviceAccess = map[string]bool{
+	"r": true, //read
+	"w": true, //write
+	"m": true, //mknod
+}
+
+// parseLinuxResourcesDeviceAccess parses the raw string passed with the --device-access-add flag
+func parseLinuxResourcesDeviceAccess(device string) (specs.LinuxDeviceCgroup, error) {
+	var devType, access string
+	var major, minor *int64
+
+	value := strings.Split(device, " ")
+	if len(value) != 3 {
+		return specs.LinuxDeviceCgroup{}, fmt.Errorf("invalid device cgroup rule requires type, major:Minor, and access rules: %q", device)
+	}
+
+	devType = value[0]
+	if !cgroupDeviceType[devType] {
+		return specs.LinuxDeviceCgroup{}, fmt.Errorf("invalid device type in device-access-add: %s", devType)
+	}
+
+	number := strings.SplitN(value[1], ":", 2)
+	i, err := strconv.ParseInt(number[0], 10, 64)
+	if err != nil {
+		return specs.LinuxDeviceCgroup{}, err
+	}
+	major = &i
+	if len(number) == 2 && number[1] != "*" {
+		i, err := strconv.ParseInt(number[1], 10, 64)
+		if err != nil {
+			return specs.LinuxDeviceCgroup{}, err
+		}
+		minor = &i
+	}
+	access = value[2]
+	for _, c := range strings.Split(access, "") {
+		if !cgroupDeviceAccess[c] {
+			return specs.LinuxDeviceCgroup{}, fmt.Errorf("invalid device access in device-access-add: %s", c)
+		}
+	}
+	return specs.LinuxDeviceCgroup{
+		Allow:  true,
+		Type:   devType,
+		Major:  major,
+		Minor:  minor,
+		Access: access,
+	}, nil
+}
diff --git a/pkg/specgenutil/util.go b/pkg/specgenutil/util.go
new file mode 100644
index 000000000..15676d086
--- /dev/null
+++ b/pkg/specgenutil/util.go
@@ -0,0 +1,274 @@
+package specgenutil
+
+import (
+	"io/ioutil"
+	"net"
+	"strconv"
+	"strings"
+
+	"github.com/containers/podman/v3/libpod/network/types"
+	"github.com/pkg/errors"
+	"github.com/sirupsen/logrus"
+)
+
+// ReadPodIDFile reads the specified file and returns its content (i.e., first
+// line).
+func ReadPodIDFile(path string) (string, error) {
+	content, err := ioutil.ReadFile(path)
+	if err != nil {
+		return "", errors.Wrap(err, "error reading pod ID file")
+	}
+	return strings.Split(string(content), "\n")[0], nil
+}
+
+// ReadPodIDFiles reads the specified files and returns their content (i.e.,
+// first line).
+func ReadPodIDFiles(files []string) ([]string, error) {
+	ids := []string{}
+	for _, file := range files {
+		id, err := ReadPodIDFile(file)
+		if err != nil {
+			return nil, err
+		}
+		ids = append(ids, id)
+	}
+	return ids, nil
+}
+
+// ParseFilters transforms one filter format to another and validates input
+func ParseFilters(filter []string) (map[string][]string, error) {
+	// TODO Remove once filter refactor is finished and url.Values done.
+	filters := map[string][]string{}
+	for _, f := range filter {
+		t := strings.SplitN(f, "=", 2)
+		filters = make(map[string][]string)
+		if len(t) < 2 {
+			return map[string][]string{}, errors.Errorf("filter input must be in the form of filter=value: %s is invalid", f)
+		}
+		filters[t[0]] = append(filters[t[0]], t[1])
+	}
+	return filters, nil
+}
+
+// createExpose parses user-provided exposed port definitions and converts them
+// into SpecGen format.
+// TODO: The SpecGen format should really handle ranges more sanely - we could
+// be massively inflating what is sent over the wire with a large range.
+func createExpose(expose []string) (map[uint16]string, error) {
+	toReturn := make(map[uint16]string)
+
+	for _, e := range expose {
+		// Check for protocol
+		proto := "tcp"
+		splitProto := strings.Split(e, "/")
+		if len(splitProto) > 2 {
+			return nil, errors.Errorf("invalid expose format - protocol can only be specified once")
+		} else if len(splitProto) == 2 {
+			proto = splitProto[1]
+		}
+
+		// Check for a range
+		start, len, err := parseAndValidateRange(splitProto[0])
+		if err != nil {
+			return nil, err
+		}
+
+		var index uint16
+		for index = 0; index < len; index++ {
+			portNum := start + index
+			protocols, ok := toReturn[portNum]
+			if !ok {
+				toReturn[portNum] = proto
+			} else {
+				newProto := strings.Join(append(strings.Split(protocols, ","), strings.Split(proto, ",")...), ",")
+				toReturn[portNum] = newProto
+			}
+		}
+	}
+
+	return toReturn, nil
+}
+
+// CreatePortBindings iterates ports mappings into SpecGen format.
+func CreatePortBindings(ports []string) ([]types.PortMapping, error) {
+	// --publish is formatted as follows:
+	// [[hostip:]hostport[-endPort]:]containerport[-endPort][/protocol]
+	toReturn := make([]types.PortMapping, 0, len(ports))
+
+	for _, p := range ports {
+		var (
+			ctrPort                 string
+			proto, hostIP, hostPort *string
+		)
+
+		splitProto := strings.Split(p, "/")
+		switch len(splitProto) {
+		case 1:
+			// No protocol was provided
+		case 2:
+			proto = &(splitProto[1])
+		default:
+			return nil, errors.Errorf("invalid port format - protocol can only be specified once")
+		}
+
+		remainder := splitProto[0]
+		haveV6 := false
+
+		// Check for an IPv6 address in brackets
+		splitV6 := strings.Split(remainder, "]")
+		switch len(splitV6) {
+		case 1:
+			// Do nothing, proceed as before
+		case 2:
+			// We potentially have an IPv6 address
+			haveV6 = true
+			if !strings.HasPrefix(splitV6[0], "[") {
+				return nil, errors.Errorf("invalid port format - IPv6 addresses must be enclosed by []")
+			}
+			if !strings.HasPrefix(splitV6[1], ":") {
+				return nil, errors.Errorf("invalid port format - IPv6 address must be followed by a colon (':')")
+			}
+			ipNoPrefix := strings.TrimPrefix(splitV6[0], "[")
+			hostIP = &ipNoPrefix
+			remainder = strings.TrimPrefix(splitV6[1], ":")
+		default:
+			return nil, errors.Errorf("invalid port format - at most one IPv6 address can be specified in a --publish")
+		}
+
+		splitPort := strings.Split(remainder, ":")
+		switch len(splitPort) {
+		case 1:
+			if haveV6 {
+				return nil, errors.Errorf("invalid port format - must provide host and destination port if specifying an IP")
+			}
+			ctrPort = splitPort[0]
+		case 2:
+			hostPort = &(splitPort[0])
+			ctrPort = splitPort[1]
+		case 3:
+			if haveV6 {
+				return nil, errors.Errorf("invalid port format - when v6 address specified, must be [ipv6]:hostPort:ctrPort")
+			}
+			hostIP = &(splitPort[0])
+			hostPort = &(splitPort[1])
+			ctrPort = splitPort[2]
+		default:
+			return nil, errors.Errorf("invalid port format - format is [[hostIP:]hostPort:]containerPort")
+		}
+
+		newPort, err := parseSplitPort(hostIP, hostPort, ctrPort, proto)
+		if err != nil {
+			return nil, err
+		}
+
+		toReturn = append(toReturn, newPort)
+	}
+
+	return toReturn, nil
+}
+
+// parseSplitPort parses individual components of the --publish flag to produce
+// a single port mapping in SpecGen format.
+func parseSplitPort(hostIP, hostPort *string, ctrPort string, protocol *string) (types.PortMapping, error) {
+	newPort := types.PortMapping{}
+	if ctrPort == "" {
+		return newPort, errors.Errorf("must provide a non-empty container port to publish")
+	}
+	ctrStart, ctrLen, err := parseAndValidateRange(ctrPort)
+	if err != nil {
+		return newPort, errors.Wrapf(err, "error parsing container port")
+	}
+	newPort.ContainerPort = ctrStart
+	newPort.Range = ctrLen
+
+	if protocol != nil {
+		if *protocol == "" {
+			return newPort, errors.Errorf("must provide a non-empty protocol to publish")
+		}
+		newPort.Protocol = *protocol
+	}
+	if hostIP != nil {
+		if *hostIP == "" {
+			return newPort, errors.Errorf("must provide a non-empty container host IP to publish")
+		} else if *hostIP != "0.0.0.0" {
+			// If hostIP is 0.0.0.0, leave it unset - CNI treats
+			// 0.0.0.0 and empty differently, Docker does not.
+			testIP := net.ParseIP(*hostIP)
+			if testIP == nil {
+				return newPort, errors.Errorf("cannot parse %q as an IP address", *hostIP)
+			}
+			newPort.HostIP = testIP.String()
+		}
+	}
+	if hostPort != nil {
+		if *hostPort == "" {
+			// Set 0 as a placeholder. The server side of Specgen
+			// will find a random, open, unused port to use.
+			newPort.HostPort = 0
+		} else {
+			hostStart, hostLen, err := parseAndValidateRange(*hostPort)
+			if err != nil {
+				return newPort, errors.Wrapf(err, "error parsing host port")
+			}
+			if hostLen != ctrLen {
+				return newPort, errors.Errorf("host and container port ranges have different lengths: %d vs %d", hostLen, ctrLen)
+			}
+			newPort.HostPort = hostStart
+		}
+	}
+
+	hport := newPort.HostPort
+	logrus.Debugf("Adding port mapping from %d to %d length %d protocol %q", hport, newPort.ContainerPort, newPort.Range, newPort.Protocol)
+
+	return newPort, nil
+}
+
+// Parse and validate a port range.
+// Returns start port, length of range, error.
+func parseAndValidateRange(portRange string) (uint16, uint16, error) {
+	splitRange := strings.Split(portRange, "-")
+	if len(splitRange) > 2 {
+		return 0, 0, errors.Errorf("invalid port format - port ranges are formatted as startPort-stopPort")
+	}
+
+	if splitRange[0] == "" {
+		return 0, 0, errors.Errorf("port numbers cannot be negative")
+	}
+
+	startPort, err := parseAndValidatePort(splitRange[0])
+	if err != nil {
+		return 0, 0, err
+	}
+
+	var rangeLen uint16 = 1
+	if len(splitRange) == 2 {
+		if splitRange[1] == "" {
+			return 0, 0, errors.Errorf("must provide ending number for port range")
+		}
+		endPort, err := parseAndValidatePort(splitRange[1])
+		if err != nil {
+			return 0, 0, err
+		}
+		if endPort <= startPort {
+			return 0, 0, errors.Errorf("the end port of a range must be higher than the start port - %d is not higher than %d", endPort, startPort)
+		}
+		// Our range is the total number of ports
+		// involved, so we need to add 1 (8080:8081 is
+		// 2 ports, for example, not 1)
+		rangeLen = endPort - startPort + 1
+	}
+
+	return startPort, rangeLen, nil
+}
+
+// Turn a single string into a valid U16 port.
+func parseAndValidatePort(port string) (uint16, error) {
+	num, err := strconv.Atoi(port)
+	if err != nil {
+		return 0, errors.Wrapf(err, "invalid port number")
+	}
+	if num < 1 || num > 65535 {
+		return 0, errors.Errorf("port numbers must be between 1 and 65535 (inclusive), got %d", num)
+	}
+	return uint16(num), nil
+}
diff --git a/pkg/specgenutil/volumes.go b/pkg/specgenutil/volumes.go
new file mode 100644
index 000000000..e9f70fc9d
--- /dev/null
+++ b/pkg/specgenutil/volumes.go
@@ -0,0 +1,630 @@
+package specgenutil
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+
+	"github.com/containers/common/pkg/parse"
+	"github.com/containers/podman/v3/libpod/define"
+	"github.com/containers/podman/v3/pkg/specgen"
+	"github.com/containers/podman/v3/pkg/util"
+	spec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/pkg/errors"
+)
+
+var (
+	errDuplicateDest = errors.Errorf("duplicate mount destination")
+	optionArgError   = errors.Errorf("must provide an argument for option")
+	noDestError      = errors.Errorf("must set volume destination")
+	errInvalidSyntax = errors.Errorf("incorrect mount format: should be --mount type=<bind|tmpfs|volume>,[src=<host-dir|volume-name>,]target=<ctr-dir>[,options]")
+)
+
+// Parse all volume-related options in the create config into a set of mounts
+// and named volumes to add to the container.
+// Handles --volumes, --mount, and --tmpfs flags.
+// Does not handle image volumes, init, and --volumes-from flags.
+// Can also add tmpfs mounts from read-only tmpfs.
+// TODO: handle options parsing/processing via containers/storage/pkg/mount
+func parseVolumes(volumeFlag, mountFlag, tmpfsFlag []string, addReadOnlyTmpfs bool) ([]spec.Mount, []*specgen.NamedVolume, []*specgen.OverlayVolume, []*specgen.ImageVolume, error) {
+	// Get mounts from the --mounts flag.
+	unifiedMounts, unifiedVolumes, unifiedImageVolumes, err := getMounts(mountFlag)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+
+	// Next --volumes flag.
+	volumeMounts, volumeVolumes, overlayVolumes, err := specgen.GenVolumeMounts(volumeFlag)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+
+	// Next --tmpfs flag.
+	tmpfsMounts, err := getTmpfsMounts(tmpfsFlag)
+	if err != nil {
+		return nil, nil, nil, nil, err
+	}
+
+	// Unify mounts from --mount, --volume, --tmpfs.
+	// Start with --volume.
+	for dest, mount := range volumeMounts {
+		if _, ok := unifiedMounts[dest]; ok {
+			return nil, nil, nil, nil, errors.Wrapf(errDuplicateDest, dest)
+		}
+		unifiedMounts[dest] = mount
+	}
+	for dest, volume := range volumeVolumes {
+		if _, ok := unifiedVolumes[dest]; ok {
+			return nil, nil, nil, nil, errors.Wrapf(errDuplicateDest, dest)
+		}
+		unifiedVolumes[dest] = volume
+	}
+	// Now --tmpfs
+	for dest, tmpfs := range tmpfsMounts {
+		if _, ok := unifiedMounts[dest]; ok {
+			return nil, nil, nil, nil, errors.Wrapf(errDuplicateDest, dest)
+		}
+		unifiedMounts[dest] = tmpfs
+	}
+
+	// If requested, add tmpfs filesystems for read-only containers.
+	if addReadOnlyTmpfs {
+		readonlyTmpfs := []string{"/tmp", "/var/tmp", "/run"}
+		options := []string{"rw", "rprivate", "nosuid", "nodev", "tmpcopyup"}
+		for _, dest := range readonlyTmpfs {
+			if _, ok := unifiedMounts[dest]; ok {
+				continue
+			}
+			if _, ok := unifiedVolumes[dest]; ok {
+				continue
+			}
+			unifiedMounts[dest] = spec.Mount{
+				Destination: dest,
+				Type:        define.TypeTmpfs,
+				Source:      "tmpfs",
+				Options:     options,
+			}
+		}
+	}
+
+	// Check for conflicts between named volumes, overlay & image volumes,
+	// and mounts
+	allMounts := make(map[string]bool)
+	testAndSet := func(dest string) error {
+		if _, ok := allMounts[dest]; ok {
+			return errors.Wrapf(errDuplicateDest, "conflict at mount destination %v", dest)
+		}
+		allMounts[dest] = true
+		return nil
+	}
+	for dest := range unifiedMounts {
+		if err := testAndSet(dest); err != nil {
+			return nil, nil, nil, nil, err
+		}
+	}
+	for dest := range unifiedVolumes {
+		if err := testAndSet(dest); err != nil {
+			return nil, nil, nil, nil, err
+		}
+	}
+	for dest := range overlayVolumes {
+		if err := testAndSet(dest); err != nil {
+			return nil, nil, nil, nil, err
+		}
+	}
+	for dest := range unifiedImageVolumes {
+		if err := testAndSet(dest); err != nil {
+			return nil, nil, nil, nil, err
+		}
+	}
+
+	// Final step: maps to arrays
+	finalMounts := make([]spec.Mount, 0, len(unifiedMounts))
+	for _, mount := range unifiedMounts {
+		if mount.Type == define.TypeBind {
+			absSrc, err := filepath.Abs(mount.Source)
+			if err != nil {
+				return nil, nil, nil, nil, errors.Wrapf(err, "error getting absolute path of %s", mount.Source)
+			}
+			mount.Source = absSrc
+		}
+		finalMounts = append(finalMounts, mount)
+	}
+	finalVolumes := make([]*specgen.NamedVolume, 0, len(unifiedVolumes))
+	for _, volume := range unifiedVolumes {
+		finalVolumes = append(finalVolumes, volume)
+	}
+	finalOverlayVolume := make([]*specgen.OverlayVolume, 0)
+	for _, volume := range overlayVolumes {
+		finalOverlayVolume = append(finalOverlayVolume, volume)
+	}
+	finalImageVolumes := make([]*specgen.ImageVolume, 0, len(unifiedImageVolumes))
+	for _, volume := range unifiedImageVolumes {
+		finalImageVolumes = append(finalImageVolumes, volume)
+	}
+
+	return finalMounts, finalVolumes, finalOverlayVolume, finalImageVolumes, nil
+}
+
+// findMountType parses the input and extracts the type of the mount type and
+// the remaining non-type tokens.
+func findMountType(input string) (mountType string, tokens []string, err error) {
+	// Split by comma, iterate over the slice and look for
+	// "type=$mountType". Everything else is appended to tokens.
+	found := false
+	for _, s := range strings.Split(input, ",") {
+		kv := strings.Split(s, "=")
+		if found || !(len(kv) == 2 && kv[0] == "type") {
+			tokens = append(tokens, s)
+			continue
+		}
+		mountType = kv[1]
+		found = true
+	}
+	if !found {
+		err = errInvalidSyntax
+	}
+	return
+}
+
+// getMounts takes user-provided input from the --mount flag and creates OCI
+// spec mounts and Libpod named volumes.
+// podman run --mount type=bind,src=/etc/resolv.conf,target=/etc/resolv.conf ...
+// podman run --mount type=tmpfs,target=/dev/shm ...
+// podman run --mount type=volume,source=test-volume, ...
+func getMounts(mountFlag []string) (map[string]spec.Mount, map[string]*specgen.NamedVolume, map[string]*specgen.ImageVolume, error) {
+	finalMounts := make(map[string]spec.Mount)
+	finalNamedVolumes := make(map[string]*specgen.NamedVolume)
+	finalImageVolumes := make(map[string]*specgen.ImageVolume)
+
+	for _, mount := range mountFlag {
+		// TODO: Docker defaults to "volume" if no mount type is specified.
+		mountType, tokens, err := findMountType(mount)
+		if err != nil {
+			return nil, nil, nil, err
+		}
+		switch mountType {
+		case define.TypeBind:
+			mount, err := getBindMount(tokens)
+			if err != nil {
+				return nil, nil, nil, err
+			}
+			if _, ok := finalMounts[mount.Destination]; ok {
+				return nil, nil, nil, errors.Wrapf(errDuplicateDest, mount.Destination)
+			}
+			finalMounts[mount.Destination] = mount
+		case define.TypeTmpfs:
+			mount, err := getTmpfsMount(tokens)
+			if err != nil {
+				return nil, nil, nil, err
+			}
+			if _, ok := finalMounts[mount.Destination]; ok {
+				return nil, nil, nil, errors.Wrapf(errDuplicateDest, mount.Destination)
+			}
+			finalMounts[mount.Destination] = mount
+		case define.TypeDevpts:
+			mount, err := getDevptsMount(tokens)
+			if err != nil {
+				return nil, nil, nil, err
+			}
+			if _, ok := finalMounts[mount.Destination]; ok {
+				return nil, nil, nil, errors.Wrapf(errDuplicateDest, mount.Destination)
+			}
+			finalMounts[mount.Destination] = mount
+		case "image":
+			volume, err := getImageVolume(tokens)
+			if err != nil {
+				return nil, nil, nil, err
+			}
+			if _, ok := finalImageVolumes[volume.Destination]; ok {
+				return nil, nil, nil, errors.Wrapf(errDuplicateDest, volume.Destination)
+			}
+			finalImageVolumes[volume.Destination] = volume
+		case "volume":
+			volume, err := getNamedVolume(tokens)
+			if err != nil {
+				return nil, nil, nil, err
+			}
+			if _, ok := finalNamedVolumes[volume.Dest]; ok {
+				return nil, nil, nil, errors.Wrapf(errDuplicateDest, volume.Dest)
+			}
+			finalNamedVolumes[volume.Dest] = volume
+		default:
+			return nil, nil, nil, errors.Errorf("invalid filesystem type %q", mountType)
+		}
+	}
+
+	return finalMounts, finalNamedVolumes, finalImageVolumes, nil
+}
+
+// Parse a single bind mount entry from the --mount flag.
+func getBindMount(args []string) (spec.Mount, error) {
+	newMount := spec.Mount{
+		Type: define.TypeBind,
+	}
+
+	var setSource, setDest, setRORW, setSuid, setDev, setExec, setRelabel bool
+
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
+		case "bind-nonrecursive":
+			newMount.Options = append(newMount.Options, "bind")
+		case "readonly", "ro", "rw":
+			if setRORW {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'readonly', 'ro', or 'rw' options more than once")
+			}
+			setRORW = true
+			// Can be formatted as one of:
+			// readonly
+			// readonly=[true|false]
+			// ro
+			// ro=[true|false]
+			// rw
+			// rw=[true|false]
+			if kv[0] == "readonly" {
+				kv[0] = "ro"
+			}
+			switch len(kv) {
+			case 1:
+				newMount.Options = append(newMount.Options, kv[0])
+			case 2:
+				switch strings.ToLower(kv[1]) {
+				case "true":
+					newMount.Options = append(newMount.Options, kv[0])
+				case "false":
+					// Set the opposite only for rw
+					// ro's opposite is the default
+					if kv[0] == "rw" {
+						newMount.Options = append(newMount.Options, "ro")
+					}
+				default:
+					return newMount, errors.Wrapf(optionArgError, "'readonly', 'ro', or 'rw' must be set to true or false, instead received %q", kv[1])
+				}
+			default:
+				return newMount, errors.Wrapf(optionArgError, "badly formatted option %q", val)
+			}
+		case "nosuid", "suid":
+			if setSuid {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'nosuid' and 'suid' options more than once")
+			}
+			setSuid = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "nodev", "dev":
+			if setDev {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'nodev' and 'dev' options more than once")
+			}
+			setDev = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "noexec", "exec":
+			if setExec {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'noexec' and 'exec' options more than once")
+			}
+			setExec = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "shared", "rshared", "private", "rprivate", "slave", "rslave", "unbindable", "runbindable", "Z", "z":
+			newMount.Options = append(newMount.Options, kv[0])
+		case "bind-propagation":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			newMount.Options = append(newMount.Options, kv[1])
+		case "src", "source":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			if len(kv[1]) == 0 {
+				return newMount, errors.Wrapf(optionArgError, "host directory cannot be empty")
+			}
+			newMount.Source = kv[1]
+			setSource = true
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
+				return newMount, err
+			}
+			newMount.Destination = filepath.Clean(kv[1])
+			setDest = true
+		case "relabel":
+			if setRelabel {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'relabel' option more than once")
+			}
+			setRelabel = true
+			if len(kv) != 2 {
+				return newMount, errors.Wrapf(util.ErrBadMntOption, "%s mount option must be 'private' or 'shared'", kv[0])
+			}
+			switch kv[1] {
+			case "private":
+				newMount.Options = append(newMount.Options, "Z")
+			case "shared":
+				newMount.Options = append(newMount.Options, "z")
+			default:
+				return newMount, errors.Wrapf(util.ErrBadMntOption, "%s mount option must be 'private' or 'shared'", kv[0])
+			}
+		case "consistency":
+			// Often used on MACs and mistakenly on Linux platforms.
+			// Since Docker ignores this option so shall we.
+			continue
+		default:
+			return newMount, errors.Wrapf(util.ErrBadMntOption, kv[0])
+		}
+	}
+
+	if !setDest {
+		return newMount, noDestError
+	}
+
+	if !setSource {
+		newMount.Source = newMount.Destination
+	}
+
+	options, err := parse.ValidateVolumeOpts(newMount.Options)
+	if err != nil {
+		return newMount, err
+	}
+	newMount.Options = options
+	return newMount, nil
+}
+
+// Parse a single tmpfs mount entry from the --mount flag
+func getTmpfsMount(args []string) (spec.Mount, error) {
+	newMount := spec.Mount{
+		Type:   define.TypeTmpfs,
+		Source: define.TypeTmpfs,
+	}
+
+	var setDest, setRORW, setSuid, setDev, setExec, setTmpcopyup bool
+
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
+		case "tmpcopyup", "notmpcopyup":
+			if setTmpcopyup {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'tmpcopyup' and 'notmpcopyup' options more than once")
+			}
+			setTmpcopyup = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "ro", "rw":
+			if setRORW {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'ro' and 'rw' options more than once")
+			}
+			setRORW = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "nosuid", "suid":
+			if setSuid {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'nosuid' and 'suid' options more than once")
+			}
+			setSuid = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "nodev", "dev":
+			if setDev {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'nodev' and 'dev' options more than once")
+			}
+			setDev = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "noexec", "exec":
+			if setExec {
+				return newMount, errors.Wrapf(optionArgError, "cannot pass 'noexec' and 'exec' options more than once")
+			}
+			setExec = true
+			newMount.Options = append(newMount.Options, kv[0])
+		case "tmpfs-mode":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			newMount.Options = append(newMount.Options, fmt.Sprintf("mode=%s", kv[1]))
+		case "tmpfs-size":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			newMount.Options = append(newMount.Options, fmt.Sprintf("size=%s", kv[1]))
+		case "src", "source":
+			return newMount, errors.Errorf("source is not supported with tmpfs mounts")
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
+				return newMount, err
+			}
+			newMount.Destination = filepath.Clean(kv[1])
+			setDest = true
+		case "consistency":
+			// Often used on MACs and mistakenly on Linux platforms.
+			// Since Docker ignores this option so shall we.
+			continue
+		default:
+			return newMount, errors.Wrapf(util.ErrBadMntOption, kv[0])
+		}
+	}
+
+	if !setDest {
+		return newMount, noDestError
+	}
+
+	return newMount, nil
+}
+
+// Parse a single devpts mount entry from the --mount flag
+func getDevptsMount(args []string) (spec.Mount, error) {
+	newMount := spec.Mount{
+		Type:   define.TypeDevpts,
+		Source: define.TypeDevpts,
+	}
+
+	var setDest bool
+
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return newMount, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
+				return newMount, err
+			}
+			newMount.Destination = filepath.Clean(kv[1])
+			setDest = true
+		default:
+			return newMount, errors.Wrapf(util.ErrBadMntOption, kv[0])
+		}
+	}
+
+	if !setDest {
+		return newMount, noDestError
+	}
+
+	return newMount, nil
+}
+
+// Parse a single volume mount entry from the --mount flag.
+// Note that the volume-label option for named volumes is currently NOT supported.
+// TODO: add support for --volume-label
+func getNamedVolume(args []string) (*specgen.NamedVolume, error) {
+	newVolume := new(specgen.NamedVolume)
+
+	var setSource, setDest, setRORW, setSuid, setDev, setExec bool
+
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
+		case "ro", "rw":
+			if setRORW {
+				return nil, errors.Wrapf(optionArgError, "cannot pass 'ro' and 'rw' options more than once")
+			}
+			setRORW = true
+			newVolume.Options = append(newVolume.Options, kv[0])
+		case "nosuid", "suid":
+			if setSuid {
+				return nil, errors.Wrapf(optionArgError, "cannot pass 'nosuid' and 'suid' options more than once")
+			}
+			setSuid = true
+			newVolume.Options = append(newVolume.Options, kv[0])
+		case "nodev", "dev":
+			if setDev {
+				return nil, errors.Wrapf(optionArgError, "cannot pass 'nodev' and 'dev' options more than once")
+			}
+			setDev = true
+			newVolume.Options = append(newVolume.Options, kv[0])
+		case "noexec", "exec":
+			if setExec {
+				return nil, errors.Wrapf(optionArgError, "cannot pass 'noexec' and 'exec' options more than once")
+			}
+			setExec = true
+			newVolume.Options = append(newVolume.Options, kv[0])
+		case "volume-label":
+			return nil, errors.Errorf("the --volume-label option is not presently implemented")
+		case "src", "source":
+			if len(kv) == 1 {
+				return nil, errors.Wrapf(optionArgError, kv[0])
+			}
+			newVolume.Name = kv[1]
+			setSource = true
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return nil, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
+				return nil, err
+			}
+			newVolume.Dest = filepath.Clean(kv[1])
+			setDest = true
+		case "consistency":
+			// Often used on MACs and mistakenly on Linux platforms.
+			// Since Docker ignores this option so shall we.
+			continue
+		default:
+			return nil, errors.Wrapf(util.ErrBadMntOption, kv[0])
+		}
+	}
+
+	if !setSource {
+		return nil, errors.Errorf("must set source volume")
+	}
+	if !setDest {
+		return nil, noDestError
+	}
+
+	return newVolume, nil
+}
+
+// Parse the arguments into an image volume. An image volume is a volume based
+// on a container image.  The container image is first mounted on the host and
+// is then bind-mounted into the container.  An ImageVolume is always mounted
+// read only.
+func getImageVolume(args []string) (*specgen.ImageVolume, error) {
+	newVolume := new(specgen.ImageVolume)
+
+	for _, val := range args {
+		kv := strings.SplitN(val, "=", 2)
+		switch kv[0] {
+		case "src", "source":
+			if len(kv) == 1 {
+				return nil, errors.Wrapf(optionArgError, kv[0])
+			}
+			newVolume.Source = kv[1]
+		case "target", "dst", "destination":
+			if len(kv) == 1 {
+				return nil, errors.Wrapf(optionArgError, kv[0])
+			}
+			if err := parse.ValidateVolumeCtrDir(kv[1]); err != nil {
+				return nil, err
+			}
+			newVolume.Destination = filepath.Clean(kv[1])
+		case "rw", "readwrite":
+			switch kv[1] {
+			case "true":
+				newVolume.ReadWrite = true
+			case "false":
+				// Nothing to do. RO is default.
+			default:
+				return nil, errors.Wrapf(util.ErrBadMntOption, "invalid rw value %q", kv[1])
+			}
+		case "consistency":
+			// Often used on MACs and mistakenly on Linux platforms.
+			// Since Docker ignores this option so shall we.
+			continue
+		default:
+			return nil, errors.Wrapf(util.ErrBadMntOption, kv[0])
+		}
+	}
+
+	if len(newVolume.Source)*len(newVolume.Destination) == 0 {
+		return nil, errors.Errorf("must set source and destination for image volume")
+	}
+
+	return newVolume, nil
+}
+
+// GetTmpfsMounts creates spec.Mount structs for user-requested tmpfs mounts
+func getTmpfsMounts(tmpfsFlag []string) (map[string]spec.Mount, error) {
+	m := make(map[string]spec.Mount)
+	for _, i := range tmpfsFlag {
+		// Default options if nothing passed
+		var options []string
+		spliti := strings.Split(i, ":")
+		destPath := spliti[0]
+		if err := parse.ValidateVolumeCtrDir(spliti[0]); err != nil {
+			return nil, err
+		}
+		if len(spliti) > 1 {
+			options = strings.Split(spliti[1], ",")
+		}
+
+		if _, ok := m[destPath]; ok {
+			return nil, errors.Wrapf(errDuplicateDest, destPath)
+		}
+
+		mount := spec.Mount{
+			Destination: filepath.Clean(destPath),
+			Type:        string(define.TypeTmpfs),
+			Options:     options,
+			Source:      string(define.TypeTmpfs),
+		}
+		m[destPath] = mount
+	}
+	return m, nil
+}