21 files changed, 399 insertions, 86 deletions

diff --git a/README.md b/README.md
index 8d9c98e81..829d50eb2 100644
--- a/README.md
+++ b/README.md
@@ -5,7 +5,7 @@
 Podman (the POD MANager) is a tool for managing containers and images, volumes mounted into those containers, and pods made from groups of containers.
 Podman is based on libpod, a library for container lifecycle management that is also contained in this repository. The libpod library provides APIs for managing containers, pods, container images, and volumes.
 
-* [Latest Version: 3.0.0](https://github.com/containers/podman/releases/latest)
+* [Latest Version: 3.1.0](https://github.com/containers/podman/releases/latest)
   * Latest Remote client for Windows
   * Latest Remote client for MacOs
   * Latest Static Remote client for Linux
diff --git a/RELEASE_NOTES.md b/RELEASE_NOTES.md
index 17d90aeca..85daba722 100644
--- a/RELEASE_NOTES.md
+++ b/RELEASE_NOTES.md
@@ -1,5 +1,136 @@
 # Release Notes
 
+## 3.1.0
+### Features
+- A set of new commands has been added to manage secrets! The `podman secret create`, `podman secret inspect`, `podman secret ls` and `podman secret rm` commands have been added to handle secrets, along with the `--secret` option to `podman run` and `podman create` to add secrets to containers. The initial driver for secrets does not support encryption - this will be added in a future release.
+- A new command to prune networks, `podman network prune`, has been added ([#8673](https://github.com/containers/podman/issues/8673)).
+- The `-v` option to `podman run` and `podman create` now supports a new volume option, `:U`, to chown the volume's source directory on the host to match the UID and GID of the container and prevent permissions issues ([#7778](https://github.com/containers/podman/issues/7778)).
+- Three new commands, `podman network exists`, `podman volume exists`, and `podman manifest exists`, have been added to check for the existence of networks, volumes, and manifest lists.
+- The `podman cp` command can now copy files into directories mounted as `tmpfs` in a running container.
+- The `podman volume prune` command will now list volumes that will be pruned when prompting the user whether to continue and perform the prune ([#8913](https://github.com/containers/podman/issues/8913)).
+- The Podman remote client's `podman build` command now supports the `--disable-compression`, `--excludes`, and `--jobs` options.
+- The Podman remote client's `podman push` command now supports the `--format` option.
+- The Podman remote client's `podman rm` command now supports the `--all` and `--ignore` options.
+- The Podman remote client's `podman search` command now supports the `--no-trunc` and `--list-tags` options.
+- The `podman play kube` command can now read in Kubernetes YAML from `STDIN` when `-` is specified as file name (`podman play kube -`), allowing input to be piped into the command for scripting ([#8996](https://github.com/containers/podman/issues/8996)).
+- The `podman generate systemd` command now supports a `--no-header` option, which disables creation of the header comment automatically added by Podman to generated unit files.
+- The `podman generate kube` command can now generate `PersistentVolumeClaim` YAML for Podman named volumes ([#5788](https://github.com/containers/podman/issues/5788)).
+- The `podman generate kube` command can now generate YAML files containing multiple resources (pods or deployments) ([#9129](https://github.com/containers/podman/issues/9129)).
+
+### Changes
+- The Podman remote client's `podman build` command no longer allows the `-v` flag to be used. Volumes are not yet supported with remote Podman when the client and service are on different machines.
+- The `podman kill` and `podman stop` commands now print the name given by the user for each container, instead of the full ID.
+- When the `--security-opt unmask=ALL` or `--security-opt unmask=/sys/fs/cgroup` options to `podman create` or `podman run` are given, Podman will mount cgroups into the container as read-write, instead of read-only ([#8441](https://github.com/containers/podman/issues/8441)).
+- The `podman rmi` command has been changed to better handle cases where an image is incomplete or corrupted, which can be caused by interrupted image pulls.
+- The `podman rename` command has been improved to be more atomic, eliminating many race conditions that could potentially render a renamed container unusable.
+- Detection of which OCI runtimes run using virtual machines and thus require custom SELinux labelling has been improved ([#9582](https://github.com/containers/podman/issues/9582)).
+- The hidden `--trace` option to `podman` has been turned into a no-op. It was used in very early versions for performance tracing, but has not been supported for some time.
+- The `podman generate systemd` command now generates `RequiresMountsFor` lines to ensure necessary storage directories are mounted before systemd starts Podman.
+- Podman will now emit a warning when `--tty` and `--interactive` are both passed, but `STDIN` is not a TTY. This will be made into an error in the next major Podman release some time next year.
+
+### Bugfixes
+- Fixed a bug where rootless Podman containers joined to CNI networks could not receive traffic from forwarded ports ([#9065](https://github.com/containers/podman/issues/9065)).
+- Fixed a bug where `podman network create` with the `--macvlan` flag did not honor the `--gateway`, `--subnet`, and `--opt` options ([#9167](https://github.com/containers/podman/issues/9167)).
+- Fixed a bug where the `podman generate kube` command generated invalid YAML for privileged containers ([#8897](https://github.com/containers/podman/issues/8897)).
+- Fixed a bug where the `podman generate kube` command could not be used with containers that were not running.
+- Fixed a bug where the `podman generate systemd` command could duplicate some parameters to Podman in generated unit files ([#9776](https://github.com/containers/podman/issues/9776)).
+- Fixed a bug where Podman did not add annotations specified in `containers.conf` to containers.
+- Foxed a bug where Podman did not respect the `no_hosts` default in `containers.conf` when creating containers.
+- Fixed a bug where the `--tail=0`, `--since`, and `--follow` options to the `podman logs` command did not function properly when using the `journald` log backend.
+- Fixed a bug where specifying more than one container to `podman logs` when the `journald` log backend was in use did not function correctly.
+- Fixed a bug where the `podman run` and `podman create` commands would panic if a memory limit was set, but the swap limit was set to unlimited ([#9429](https://github.com/containers/podman/issues/9429)).
+- Fixed a bug where the `--network` option to `podman run`, `podman create`, and `podman pod create` would error if the user attempted to specify CNI networks by ID, instead of name ([#9451](https://github.com/containers/podman/issues/9451)).
+- Fixed a bug where Podman's cgroup handling for cgroups v1 systems did not properly handle cases where a cgroup existed on some, but not all, controllers, resulting in errors from the `podman stats` command ([#9252](https://github.com/containers/podman/issues/9252)).
+- Fixed a bug where the `podman cp` did not properly handle cases where `/dev/stdout` was specified as the destination (it was treated identically to `-`) ([#9362](https://github.com/containers/podman/issues/9362)).
+- Fixed a bug where the `podman cp` command would create files with incorrect ownership ([#9526](https://github.com/containers/podman/issues/9626)).
+- Fixed a bug where the `podman cp` command did not properly handle cases where the destination directory did not exist.
+- Fixed a bug where the `podman cp` command did not properly evaluate symlinks when copying out of containers.
+- Fixed a bug where the `podman rm -fa` command would error when attempting to remove containers created with `--rm` ([#9479](https://github.com/containers/podman/issues/9479)).
+- Fixed a bug where the ordering of capabilities was nondeterministic in the `CapDrop` field of the output of `podman inspect` on a container ([#9490](https://github.com/containers/podman/issues/9490)).
+- Fixed a bug where the `podman network connect` command could be used with containers that were not initially connected to a CNI bridge network (e.g. containers created with `--net=host`) ([#9496](https://github.com/containers/podman/issues/9496)).
+- Fixed a bug where DNS search domains required by the `dnsname` CNI plugin were not being added to container's `resolv.conf` under some circumstances.
+- Fixed a bug where the `--ignorefile` option to `podman build` was nonfunctional ([#9570](https://github.com/containers/podman/issues/9570)).
+- Fixed a bug where the `--timestamp` option to `podman build` was nonfunctional ([#9569](https://github.com/containers/podman/issues/9569)).
+- Fixed a bug where the `--iidfile` option to `podman build` could cause Podman to panic if an error occurred during the build.
+- Fixed a bug where the `--dns-search` option to `podman build` was nonfunctional ([#9574](https://github.com/containers/podman/issues/9574)).
+- Fixed a bug where the `--pull-never` option to `podman build` was nonfunctional ([#9573](https://github.com/containers/podman/issues/9573)).
+- Fixed a bug where the `--build-arg` option to `podman build` would, when given a key but not a value, error (instead of attempting to look up the key as an environment variable) ([#9571](https://github.com/containers/podman/issues/9571)).
+- Fixed a bug where the `--isolation` option to `podman build` in the remote Podman client was nonfunctional.
+- Fixed a bug where the `podman network disconnect` command could cause errors when the container that had a network removed was stopped and its network was cleaned up ([#9602](https://github.com/containers/podman/issues/9602)).
+- Fixed a bug where the `podman network rm` command did not properly check what networks a container was present in, resulting in unexpected behavior if `podman network connect` or `podman network disconnect` had been used with the network ([#9632](https://github.com/containers/podman/issues/9632)).
+- Fixed a bug where some errors with stopping a container could cause Podman to panic, and the container to be stuck in an unusable `stopping` state ([#9615](https://github.com/containers/podman/issues/9615)).
+- Fixed a bug where the `podman load` command could return 0 even in cases where an error occurred ([#9672](https://github.com/containers/podman/issues/9672)).
+- Fixed a bug where specifying storage options to Podman using the `--storage-opt` option would override all storage options. Instead, storage options are now overridden only when the `--storage-driver` option is used to override the current graph driver ([#9657](https://github.com/containers/podman/issues/9657)).
+- Fixed a bug where containers created with `--privileged` could request more capabilities than were available to Podman.
+- Fixed a bug where `podman commit` did not use the `TMPDIR` environment variable to place temporary files created during the commit ([#9825](https://github.com/containers/podman/issues/9825)).
+- Fixed a bug where remote Podman could error when attempting to resize short-lived containers ([#9831](https://github.com/containers/podman/issues/9831)).
+- Fixed a bug where Podman was unusable on kernels built without `CONFIG_USER_NS`.
+- Fixed a bug where the ownership of volumes created by `podman volume create` and then mounted into a container could be incorrect ([#9608](https://github.com/containers/podman/issues/9608)).
+- Fixed a bug where Podman volumes using a volume plugin could not pass certain options, and could not be used as non-root users.
+- Fixed a bug where the `--tz` option to `podman create` and `podman run` did not properly validate its input.
+
+### API
+- Fixed a bug where the `X-Registry-Auth` header did not accept `null` as a valid value.
+- A new compat endpoint, `/auth`, has been added. This endpoint validates credentials against a registry ([#9564](https://github.com/containers/podman/issues/9564)).
+- Fixed a bug where the compat Build endpoint for Images specified labels using the wrong type (array vs map). Both formats will be accepted now.
+- Fixed a bug where the compat Build endpoint for Images did not report that it successfully tagged the built image in its response.
+- Fixed a bug where the compat Create endpoint for Images did not provide progress information on pulling the image in its response.
+- Fixed a bug where the compat Push endpoint for Images did not properly handle the destination (used a query parameter, instead of a path parameter).
+- Fixed a bug where the compat Push endpoint for Images did not send the progress of the push and the digest of the pushed image in the response body.
+- Fixed a bug where the compat List endpoint for Networks returned null, instead of an empty array (`[]`), when no networks were present ([#9293](https://github.com/containers/podman/issues/9293)).
+- Fixed a bug where the compat List endpoint for Networks returned nulls, instead of empty maps, for networks that do not have Labels and/or Options.
+- The Libpod Inspect endpoint for networks (`/libpod/network/$ID/json`) now has an alias at `/libpod/network/$ID` ([#9691](https://github.com/containers/podman/issues/9691)).
+- Fixed a bug where the libpod Inspect endpoint for Networks returned a 1-size array of results, instead of a single result ([#9690](https://github.com/containers/podman/issues/9690)).
+- The Compat List endpoint for Networks now supports the legacy format for filters in parallel with the current filter format ([#9526](https://github.com/containers/podman/issues/9526)).
+- Fixed a bug where the compat Create endpoint for Containers did not properly handle tmpfs filesystems specified with options ([#9511](https://github.com/containers/podman/issues/9511)).
+- Fixed a bug where the compat Create endpoint for Containers did not create bind-mount source directories ([#9510](https://github.com/containers/podman/issues/9510)).
+- Fixed a bug where the compat Create endpoint for Containers did not properly handle the `NanoCpus` option ([#9523](https://github.com/containers/podman/issues/9523)).
+- Fixed a bug where the Libpod create endpoint for Containers has a misnamed field in its JSON.
+- Fixed a bug where the compat List endpoint for Containers did not populate information on forwarded ports ([#9553](https://github.com/containers/podman/issues/9553))
+- Fixed a bug where the compat List endpoint for Containers did not populate information on container CNI networks ([#9529](https://github.com/containers/podman/issues/9529)).
+- Fixed a bug where the compat and libpod Stop endpoints for Containers would ignore a timeout of 0.
+- Fixed a bug where the compat and libpod Resize endpoints for Containers did not set the correct terminal sizes (dimensions were reversed) ([#9756](https://github.com/containers/podman/issues/9756)).
+- Fixed a bug where the compat Remove endpoint for Containers would not return 404 when attempting to remove a container that does not exist ([#9675](https://github.com/containers/podman/issues/9675)).
+- Fixed a bug where the compat Prune endpoint for Volumes would still prune even if an invalid filter was specified.
+- Numerous bugs related to filters have been addressed.
+
+### Misc
+- Updated Buildah to v1.20.0
+- Updated the containers/storage library to v1.28.1
+- Updated the containers/image library to v5.10.5
+- Updated the containers/common library to v0.35.4
+
+## 3.0.1
+### Changes
+- Several frequently-occurring `WARN` level log messages have been downgraded to `INFO` or `DEBUG` to not clutter terminal output.
+
+### Bugfixes
+- Fixed a bug where the `Created` field of `podman ps --format=json` was formatted as a string instead of an Unix timestamp (integer) ([#9315](https://github.com/containers/podman/issues/9315)).
+- Fixed a bug where failing lookups of individual layers during the `podman images` command would cause the whole command to fail without printing output.
+- Fixed a bug where `--cgroups=split` did not function properly on cgroups v1 systems.
+- Fixed a bug where mounting a volume over an directory in the container that existed, but was empty, could fail ([#9393](https://github.com/containers/podman/issues/9393)).
+- Fixed a bug where mounting a volume over a directory in the container that existed could copy the entirety of the container's rootfs, instead of just the directory mounted over, into the volume ([#9415](https://github.com/containers/podman/pull/9415)).
+- Fixed a bug where Podman would treat the `--entrypoint=[""]` option to `podman run` and `podman create` as a literal empty string in the entrypoint, when instead it should have been ignored ([#9377](https://github.com/containers/podman/issues/9377)).
+- Fixed a bug where Podman would set the `HOME` environment variable to `""` when the container ran as a user without an assigned home directory ([#9378](https://github.com/containers/podman/issues/9378)).
+- Fixed a bug where specifying a pod infra image that had no tags (by using its ID) would cause `podman pod create` to panic ([#9374](https://github.com/containers/podman/issues/9374)).
+- Fixed a bug where the `--runtime` option was not properly handled by the `podman build` command ([#9365](https://github.com/containers/podman/issues/9365)).
+- Fixed a bug where Podman would incorrectly print an error message related to the remote API when the remote API was not in use and starting Podman failed.
+- Fixed a bug where Podman would change ownership of a container's working directory, even if it already existed ([#9387](https://github.com/containers/podman/issues/9387)).
+- Fixed a bug where the `podman generate systemd --new` command would incorrectly escape `%t` when generating the path for the PID file ([#9373](https://github.com/containers/podman/issues/9373)).
+- Fixed a bug where Podman could, when run inside a Podman container with the host's containers/storage directory mounted into the container, erroneously detect a reboot and reset container state if the temporary directory was not also mounted in ([#9191](https://github.com/containers/podman/issues/9191)).
+- Fixed a bug where some options of the `podman build` command (including but not limited to `--jobs`) were nonfunctional ([#9247](https://github.com/containers/podman/issues/9247)).
+
+### API
+- Fixed a breaking change to the Libpod Wait API for Containers where the Conditions parameter changed type in Podman v3.0 ([#9351](https://github.com/containers/podman/issues/9351)).
+- Fixed a bug where the Compat Create endpoint for Containers did not properly handle forwarded ports that did not specify a host port.
+- Fixed a bug where the Libpod Wait endpoint for Containers could write duplicate headers after an error occurred.
+- Fixed a bug where the Compat Create endpoint for Images would not pull images that already had a matching tag present locally, even if a more recent version was available at the registry ([#9232](https://github.com/containers/podman/issues/9232)).
+- The Compat Create endpoint for Images has had its compatibility with Docker improved, allowing its use with the `docker-java` library.
+
+### Misc
+- Updated Buildah to v1.19.4
+- Updated the containers/storage library to v1.24.6
+
 ## 3.0.0
 ### Features
 - Podman now features initial support for Docker Compose.
diff --git a/cmd/podman/common/create.go b/cmd/podman/common/create.go
index d1170710b..dda709ecd 100644
--- a/cmd/podman/common/create.go
+++ b/cmd/podman/common/create.go
@@ -765,11 +765,15 @@ func DefineCreateFlags(cmd *cobra.Command, cf *ContainerCLIOpts) {
 	)
 	_ = cmd.RegisterFlagCompletionFunc(mountFlagName, AutocompleteMountFlag)
 
+	volumeDesciption := "Bind mount a volume into the container"
+	if registry.IsRemote() {
+		volumeDesciption = "Bind mount a volume into the container. Volume src will be on the server machine, not the client"
+	}
 	volumeFlagName := "volume"
 	createFlags.StringArrayVarP(
 		&cf.Volume,
 		volumeFlagName, "v", volumes(),
-		"Bind mount a volume into the container",
+		volumeDesciption,
 	)
 	_ = cmd.RegisterFlagCompletionFunc(volumeFlagName, AutocompleteVolumeFlag)
 
@@ -804,4 +808,10 @@ func DefineCreateFlags(cmd *cobra.Command, cf *ContainerCLIOpts) {
 		"Configure cgroup v2 (key=value)",
 	)
 	_ = cmd.RegisterFlagCompletionFunc(cgroupConfFlagName, completion.AutocompleteNone)
+
+	_ = createFlags.MarkHidden("signature-policy")
+	if registry.IsRemote() {
+		_ = createFlags.MarkHidden("env-host")
+		_ = createFlags.MarkHidden("http-proxy")
+	}
 }
diff --git a/cmd/podman/containers/create.go b/cmd/podman/containers/create.go
index af9278ce1..2da9aaf5e 100644
--- a/cmd/podman/containers/create.go
+++ b/cmd/podman/containers/create.go
@@ -63,11 +63,6 @@ func createFlags(cmd *cobra.Command) {
 	common.DefineNetFlags(cmd)
 
 	flags.SetNormalizeFunc(utils.AliasFlags)
-
-	_ = flags.MarkHidden("signature-policy")
-	if registry.IsRemote() {
-		_ = flags.MarkHidden("http-proxy")
-	}
 }
 
 func init() {
diff --git a/cmd/podman/containers/run.go b/cmd/podman/containers/run.go
index db7180ca9..1a9fa2f0f 100644
--- a/cmd/podman/containers/run.go
+++ b/cmd/podman/containers/run.go
@@ -76,13 +76,11 @@ func runFlags(cmd *cobra.Command) {
 	detachKeysFlagName := "detach-keys"
 	flags.StringVar(&runOpts.DetachKeys, detachKeysFlagName, containerConfig.DetachKeys(), "Override the key sequence for detaching a container. Format is a single character `[a-Z]` or a comma separated sequence of `ctrl-<value>`, where `<value>` is one of: `a-cf`, `@`, `^`, `[`, `\\`, `]`, `^` or `_`")
 	_ = cmd.RegisterFlagCompletionFunc(detachKeysFlagName, common.AutocompleteDetachKeys)
-
-	_ = flags.MarkHidden("signature-policy")
 	if registry.IsRemote() {
-		_ = flags.MarkHidden("http-proxy")
 		_ = flags.MarkHidden("preserve-fds")
 	}
 }
+
 func init() {
 	registry.Commands = append(registry.Commands, registry.CliCommand{
 		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
diff --git a/cmd/podman/machine/init.go b/cmd/podman/machine/init.go
index 05474fd89..61261e008 100644
--- a/cmd/podman/machine/init.go
+++ b/cmd/podman/machine/init.go
@@ -1,4 +1,4 @@
-// +build amd64,linux amd64,darwin arm64,darwin
+// +build amd64,linux arm64,linux amd64,darwin arm64,darwin
 
 package machine
 
diff --git a/cmd/podman/machine/machine.go b/cmd/podman/machine/machine.go
index ed284ee10..9a2377d12 100644
--- a/cmd/podman/machine/machine.go
+++ b/cmd/podman/machine/machine.go
@@ -1,4 +1,4 @@
-// +build amd64,linux amd64,darwin arm64,darwin
+// +build amd64,linux arm64,linux amd64,darwin arm64,darwin
 
 package machine
 
diff --git a/cmd/podman/machine/machine_unsupported.go b/cmd/podman/machine/machine_unsupported.go
index cb1636419..3bb44b51f 100644
--- a/cmd/podman/machine/machine_unsupported.go
+++ b/cmd/podman/machine/machine_unsupported.go
@@ -1,4 +1,4 @@
-// +build !amd64 arm64,linux amd64,windows
+// +build !amd64 amd64,windows
 
 package machine
 
diff --git a/cmd/podman/machine/rm.go b/cmd/podman/machine/rm.go
index cd2cc84f2..002a793a3 100644
--- a/cmd/podman/machine/rm.go
+++ b/cmd/podman/machine/rm.go
@@ -1,4 +1,4 @@
-// +build amd64,linux amd64,darwin arm64,darwin
+// +build amd64,linux arm64,linux amd64,darwin arm64,darwin
 
 package machine
 
diff --git a/cmd/podman/machine/ssh.go b/cmd/podman/machine/ssh.go
index 879122a14..586c4267d 100644
--- a/cmd/podman/machine/ssh.go
+++ b/cmd/podman/machine/ssh.go
@@ -1,4 +1,4 @@
-// +build amd64,linux amd64,darwin arm64,darwin
+// +build amd64,linux arm64,linux amd64,darwin arm64,darwin
 
 package machine
 
diff --git a/cmd/podman/machine/start.go b/cmd/podman/machine/start.go
index 80fd77102..40800160e 100644
--- a/cmd/podman/machine/start.go
+++ b/cmd/podman/machine/start.go
@@ -1,4 +1,4 @@
-// +build amd64,linux amd64,darwin arm64,darwin
+// +build amd64,linux arm64,linux amd64,darwin arm64,darwin
 
 package machine
 
diff --git a/cmd/podman/machine/stop.go b/cmd/podman/machine/stop.go
index 4fcb065a3..7d655f0ba 100644
--- a/cmd/podman/machine/stop.go
+++ b/cmd/podman/machine/stop.go
@@ -1,4 +1,4 @@
-// +build amd64,linux amd64,darwin arm64,darwin
+// +build amd64,linux arm64,linux amd64,darwin arm64,darwin
 
 package machine
 
diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md
index 9ae4ab207..f56319cf3 100644
--- a/docs/source/markdown/podman-create.1.md
+++ b/docs/source/markdown/podman-create.1.md
@@ -1029,7 +1029,7 @@ Create a bind mount. If you specify, ` -v /HOST-DIR:/CONTAINER-DIR`, Podman
 bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the Podman
 container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` will mount the volume
 in the host to the container. If no such named volume exists, Podman will
-create one. The `OPTIONS` are a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup>
+create one. The `OPTIONS` are a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup>  (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.)
 
 The _options_ is a comma delimited list and can be:
 
diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md
index 6d9d5ba28..fcb5a13ec 100644
--- a/docs/source/markdown/podman-run.1.md
+++ b/docs/source/markdown/podman-run.1.md
@@ -744,7 +744,7 @@ If a container is run within a pod, and the pod has an infra-container, the infr
 #### **\-\-preserve-fds**=*N*
 
 Pass down to the process N additional file descriptors (in addition to 0, 1, 2).
-The total FDs will be 3+N.
+The total FDs will be 3+N. (This option is not available with the remote Podman client)
 
 #### **\-\-privileged**=**true**|**false**
 
@@ -1104,7 +1104,7 @@ Create a bind mount. If you specify _/HOST-DIR_:_/CONTAINER-DIR_, Podman
 bind mounts _host-dir_ in the host to _CONTAINER-DIR_ in the Podman
 container. Similarly, _SOURCE-VOLUME_:_/CONTAINER-DIR_ will mount the volume
 in the host to the container. If no such named volume exists, Podman will
-create one.
+create one. (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.)
 
 The _options_ is a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup>
 
diff --git a/libpod/networking_linux.go b/libpod/networking_linux.go
index d6968a6b5..8bf532f66 100644
--- a/libpod/networking_linux.go
+++ b/libpod/networking_linux.go
@@ -916,7 +916,8 @@ func (r *Runtime) reloadContainerNetwork(ctr *Container) ([]*cnitypes.Result, er
 		// teardownCNI will error if the iptables rules do not exists and this is the case after
 		// a firewall reload. The purpose of network reload is to recreate the rules if they do
 		// not exists so we should not log this specific error as error. This would confuse users otherwise.
-		b, rerr := regexp.MatchString("Couldn't load target `CNI-[a-f0-9]{24}':No such file or directory", err.Error())
+		// iptables-legacy and iptables-nft will create different errors make sure to match both.
+		b, rerr := regexp.MatchString("Couldn't load target `CNI-[a-f0-9]{24}':No such file or directory|Chain 'CNI-[a-f0-9]{24}' does not exist", err.Error())
 		if rerr == nil && !b {
 			logrus.Error(err)
 		} else {
diff --git a/pkg/machine/fcos.go b/pkg/machine/fcos.go
index 0c6a2485e..32f943c87 100644
--- a/pkg/machine/fcos.go
+++ b/pkg/machine/fcos.go
@@ -2,17 +2,13 @@ package machine
 
 import (
 	"crypto/sha256"
-	"io"
 	"io/ioutil"
 	url2 "net/url"
-	"os"
 	"path/filepath"
 	"runtime"
 	"strings"
 
-	"github.com/containers/storage/pkg/archive"
 	digest "github.com/opencontainers/go-digest"
-	"github.com/sirupsen/logrus"
 )
 
 // These should eventually be moved into machine/qemu as
@@ -75,41 +71,7 @@ func (f FcosDownload) DownloadImage() error {
 			return err
 		}
 	}
-	uncompressedFileWriter, err := os.OpenFile(f.getLocalUncompressedName(), os.O_CREATE|os.O_RDWR, 0600)
-	if err != nil {
-		return err
-	}
-	sourceFile, err := ioutil.ReadFile(f.LocalPath)
-	if err != nil {
-		return err
-	}
-	compressionType := archive.DetectCompression(sourceFile)
-	f.CompressionType = compressionType.Extension()
-
-	switch f.CompressionType {
-	case "tar.xz":
-		return decompressXZ(f.LocalPath, uncompressedFileWriter)
-	default:
-		// File seems to be uncompressed, make a copy
-		if err := copyFile(f.LocalPath, uncompressedFileWriter); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-func copyFile(src string, dest *os.File) error {
-	source, err := os.Open(src)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		if err := source.Close(); err != nil {
-			logrus.Error(err)
-		}
-	}()
-	_, err = io.Copy(dest, source)
-	return err
+	return Decompress(f.LocalPath, f.getLocalUncompressedName())
 }
 
 func (f FcosDownload) Get() *Download {
diff --git a/pkg/machine/fcos_arm64.go b/pkg/machine/fcos_arm64.go
index ab50ca874..f5cd5a505 100644
--- a/pkg/machine/fcos_arm64.go
+++ b/pkg/machine/fcos_arm64.go
@@ -2,9 +2,9 @@ package machine
 
 import (
 	"encoding/json"
-	"fmt"
 	"io/ioutil"
 	"net/http"
+	url2 "net/url"
 
 	"github.com/sirupsen/logrus"
 )
@@ -14,9 +14,7 @@ const aarchBaseURL = "https://fedorapeople.org/groups/fcos-images/builds/latest/
 // Total hack until automation is possible.
 // We need a proper json file at least to automate
 func getFCOSDownload() (*fcosDownloadInfo, error) {
-
 	meta := Build{}
-	fmt.Println(aarchBaseURL + "meta.json")
 	resp, err := http.Get(aarchBaseURL + "meta.json")
 	if err != nil {
 		return nil, err
@@ -33,8 +31,18 @@ func getFCOSDownload() (*fcosDownloadInfo, error) {
 	if err := json.Unmarshal(body, &meta); err != nil {
 		return nil, err
 	}
+	pathURL, err := url2.Parse(meta.BuildArtifacts.Qemu.Path)
+	if err != nil {
+		return nil, err
+	}
+
+	baseURL, err := url2.Parse(aarchBaseURL)
+	if err != nil {
+		return nil, err
+	}
+	pullURL := baseURL.ResolveReference(pathURL)
 	return &fcosDownloadInfo{
-		Location:  "https://fedorapeople.org/groups/fcos-images/builds/latest/aarch64/fedora-coreos-33.20210310.dev.0-qemu.aarch64.qcow2",
+		Location:  pullURL.String(),
 		Release:   "",
 		Sha256Sum: meta.BuildArtifacts.Qemu.Sha256,
 	}, nil
diff --git a/pkg/machine/pull.go b/pkg/machine/pull.go
index 39dde15b8..41abe6993 100644
--- a/pkg/machine/pull.go
+++ b/pkg/machine/pull.go
@@ -3,17 +3,94 @@ package machine
 import (
 	"fmt"
 	"io"
+	"io/ioutil"
 	"net/http"
+	url2 "net/url"
 	"os"
 	"os/exec"
+	"path/filepath"
 	"strings"
 	"time"
 
+	"github.com/containers/image/v5/pkg/compression"
+	"github.com/docker/docker/pkg/archive"
 	"github.com/sirupsen/logrus"
 	"github.com/vbauerster/mpb/v6"
 	"github.com/vbauerster/mpb/v6/decor"
 )
 
+// GenericDownload is used when a user provides a URL
+// or path for an image
+type GenericDownload struct {
+	Download
+}
+
+// NewGenericDownloader is used when the disk image is provided by the user
+func NewGenericDownloader(vmType, vmName, pullPath string) (DistributionDownload, error) {
+	var (
+		imageName string
+	)
+	dataDir, err := GetDataDir(vmType)
+	if err != nil {
+		return nil, err
+	}
+	dl := Download{}
+	// Is pullpath a file or url?
+	getURL, err := url2.Parse(pullPath)
+	if err != nil {
+		return nil, err
+	}
+	if len(getURL.Scheme) > 0 {
+		urlSplit := strings.Split(pullPath, "/")
+		imageName = urlSplit[len(urlSplit)-1]
+		dl.LocalUncompressedFile = filepath.Join(dataDir, imageName)
+		dl.URL = getURL
+		dl.LocalPath = filepath.Join(dataDir, imageName)
+	} else {
+		// Dealing with FilePath
+		imageName = filepath.Base(pullPath)
+		dl.LocalUncompressedFile = filepath.Join(dataDir, imageName)
+		dl.LocalPath = pullPath
+	}
+	dl.VMName = vmName
+	dl.ImageName = imageName
+	// The download needs to be pulled into the datadir
+
+	gd := GenericDownload{Download: dl}
+	gd.LocalUncompressedFile = gd.getLocalUncompressedName()
+	return gd, nil
+}
+
+func (g GenericDownload) getLocalUncompressedName() string {
+	var (
+		extension string
+	)
+	switch {
+	case strings.HasSuffix(g.LocalPath, ".bz2"):
+		extension = ".bz2"
+	case strings.HasSuffix(g.LocalPath, ".gz"):
+		extension = ".gz"
+	case strings.HasSuffix(g.LocalPath, ".xz"):
+		extension = ".xz"
+	}
+	uncompressedFilename := filepath.Join(filepath.Dir(g.LocalUncompressedFile), g.VMName+"_"+g.ImageName)
+	return strings.TrimSuffix(uncompressedFilename, extension)
+}
+
+func (g GenericDownload) DownloadImage() error {
+	// If we have a URL for this "downloader", we now pull it
+	if g.URL != nil {
+		if err := DownloadVMImage(g.URL, g.LocalPath); err != nil {
+			return err
+		}
+	}
+	return Decompress(g.LocalPath, g.getLocalUncompressedName())
+}
+
+func (g GenericDownload) Get() *Download {
+	return &g.Download
+}
+
 // DownloadVMImage downloads a VM image from url to given path
 // with download status
 func DownloadVMImage(downloadURL fmt.Stringer, localImagePath string) error {
@@ -38,7 +115,7 @@ func DownloadVMImage(downloadURL fmt.Stringer, localImagePath string) error {
 	}()
 
 	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("error downloading VM image: %s", resp.Status)
+		return fmt.Errorf("error downloading VM image %s: %s", downloadURL, resp.Status)
 	}
 	size := resp.ContentLength
 	urlSplit := strings.Split(downloadURL.String(), "/")
@@ -75,6 +152,22 @@ func DownloadVMImage(downloadURL fmt.Stringer, localImagePath string) error {
 	return nil
 }
 
+func Decompress(localPath, uncompressedPath string) error {
+	uncompressedFileWriter, err := os.OpenFile(uncompressedPath, os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		return err
+	}
+	sourceFile, err := ioutil.ReadFile(localPath)
+	if err != nil {
+		return err
+	}
+
+	if compressionType := archive.DetectCompression(sourceFile); compressionType.Extension() == "tar.xz" {
+		return decompressXZ(localPath, uncompressedFileWriter)
+	}
+	return decompressEverythingElse(localPath, uncompressedFileWriter)
+}
+
 // Will error out if file without .xz already exists
 // Maybe extracting then renameing is a good idea here..
 // depends on xz: not pre-installed on mac, so it becomes a brew dependecy
@@ -95,3 +188,23 @@ func decompressXZ(src string, output io.Writer) error {
 	}()
 	return cmd.Run()
 }
+
+func decompressEverythingElse(src string, output io.Writer) error {
+	fmt.Println("Extracting compressed file")
+	f, err := os.Open(src)
+	if err != nil {
+		return err
+	}
+	uncompressStream, _, err := compression.AutoDecompress(f)
+	if err != nil {
+		return err
+	}
+	defer func() {
+		if err := uncompressStream.Close(); err != nil {
+			logrus.Error(err)
+		}
+	}()
+
+	_, err = io.Copy(output, uncompressStream)
+	return err
+}
diff --git a/pkg/machine/qemu/machine.go b/pkg/machine/qemu/machine.go
index fe155750f..fdb528a86 100644
--- a/pkg/machine/qemu/machine.go
+++ b/pkg/machine/qemu/machine.go
@@ -12,9 +12,8 @@ import (
 	"strconv"
 	"time"
 
-	"github.com/containers/podman/v3/utils"
-
 	"github.com/containers/podman/v3/pkg/machine"
+	"github.com/containers/podman/v3/utils"
 	"github.com/containers/storage/pkg/homedir"
 	"github.com/digitalocean/go-qemu/qmp"
 	"github.com/pkg/errors"
@@ -83,7 +82,7 @@ func NewMachine(opts machine.InitOptions) (machine.VM, error) {
 		return nil, err
 	}
 	vm.QMPMonitor = monitor
-	cmd = append(cmd, []string{"-qmp", monitor.Network + ":/" + monitor.Address + ",server,nowait"}...)
+	cmd = append(cmd, []string{"-qmp", monitor.Network + ":/" + monitor.Address + ",server=on,wait=off"}...)
 
 	// Add network
 	cmd = append(cmd, "-nic", "user,model=virtio,hostfwd=tcp::"+strconv.Itoa(vm.Port)+"-:22")
@@ -96,7 +95,7 @@ func NewMachine(opts machine.InitOptions) (machine.VM, error) {
 	// Add serial port for readiness
 	cmd = append(cmd, []string{
 		"-device", "virtio-serial",
-		"-chardev", "socket,path=" + virtualSocketPath + ",server,nowait,id=" + vm.Name + "_ready",
+		"-chardev", "socket,path=" + virtualSocketPath + ",server=on,wait=off,id=" + vm.Name + "_ready",
 		"-device", "virtserialport,chardev=" + vm.Name + "_ready" + ",name=org.fedoraproject.port.0"}...)
 	vm.CmdLine = cmd
 	return vm, nil
@@ -135,15 +134,29 @@ func (v *MachineVM) Init(opts machine.InitOptions) error {
 	jsonFile := filepath.Join(vmConfigDir, v.Name) + ".json"
 	v.IdentityPath = filepath.Join(sshDir, v.Name)
 
-	dd, err := machine.NewFcosDownloader(vmtype, v.Name)
-	if err != nil {
-		return err
+	// The user has provided an alternate image which can be a file path
+	// or URL.
+	if len(opts.ImagePath) > 0 {
+		g, err := machine.NewGenericDownloader(vmtype, v.Name, opts.ImagePath)
+		if err != nil {
+			return err
+		}
+		v.ImagePath = g.Get().LocalUncompressedFile
+		if err := g.DownloadImage(); err != nil {
+			return err
+		}
+	} else {
+		// Get the image as usual
+		dd, err := machine.NewFcosDownloader(vmtype, v.Name)
+		if err != nil {
+			return err
+		}
+		v.ImagePath = dd.Get().LocalUncompressedFile
+		if err := dd.DownloadImage(); err != nil {
+			return err
+		}
 	}
 
-	v.ImagePath = dd.Get().LocalUncompressedFile
-	if err := dd.DownloadImage(); err != nil {
-		return err
-	}
 	// Add arch specific options including image location
 	v.CmdLine = append(v.CmdLine, v.addArchOptions()...)
 
@@ -171,10 +184,20 @@ func (v *MachineVM) Init(opts machine.InitOptions) error {
 		return err
 	}
 
+	originalDiskSize, err := getDiskSize(v.ImagePath)
+	if err != nil {
+		return err
+	}
 	// Resize the disk image to input disk size
-	resize := exec.Command("qemu-img", []string{"resize", v.ImagePath, strconv.Itoa(int(opts.DiskSize)) + "G"}...)
-	if err := resize.Run(); err != nil {
-		return errors.Errorf("error resizing image: %q", err)
+	// only if the virtualdisk size is less than
+	// the given disk size
+	if opts.DiskSize<<(10*3) > originalDiskSize {
+		resize := exec.Command("qemu-img", []string{"resize", v.ImagePath, strconv.Itoa(int(opts.DiskSize)) + "G"}...)
+		resize.Stdout = os.Stdout
+		resize.Stderr = os.Stderr
+		if err := resize.Run(); err != nil {
+			return errors.Errorf("error resizing image: %q", err)
+		}
 	}
 	// Write the ignition file
 	ign := machine.DynamicIgnition{
@@ -372,3 +395,34 @@ func (v *MachineVM) SSH(name string, opts machine.SSHOptions) error {
 
 	return cmd.Run()
 }
+
+// executes qemu-image info to get the virtual disk size
+// of the diskimage
+func getDiskSize(path string) (uint64, error) {
+	diskInfo := exec.Command("qemu-img", "info", "--output", "json", path)
+	stdout, err := diskInfo.StdoutPipe()
+	if err != nil {
+		return 0, err
+	}
+	if err := diskInfo.Start(); err != nil {
+		return 0, err
+	}
+	tmpInfo := struct {
+		VirtualSize    uint64 `json:"virtual-size"`
+		Filename       string `json:"filename"`
+		ClusterSize    int64  `json:"cluster-size"`
+		Format         string `json:"format"`
+		FormatSpecific struct {
+			Type string            `json:"type"`
+			Data map[string]string `json:"data"`
+		}
+		DirtyFlag bool `json:"dirty-flag"`
+	}{}
+	if err := json.NewDecoder(stdout).Decode(&tmpInfo); err != nil {
+		return 0, err
+	}
+	if err := diskInfo.Wait(); err != nil {
+		return 0, err
+	}
+	return tmpInfo.VirtualSize, nil
+}
diff --git a/pkg/machine/qemu/options_linux_arm64.go b/pkg/machine/qemu/options_linux_arm64.go
new file mode 100644
index 000000000..948117653
--- /dev/null
+++ b/pkg/machine/qemu/options_linux_arm64.go
@@ -0,0 +1,41 @@
+package qemu
+
+import (
+	"os"
+	"path/filepath"
+)
+
+var (
+	QemuCommand = "qemu-system-aarch64"
+)
+
+func (v *MachineVM) addArchOptions() []string {
+	opts := []string{
+		"-accel", "kvm",
+		"-cpu", "host",
+		"-M", "virt,gic-version=max",
+		"-bios", getQemuUefiFile("QEMU_EFI.fd"),
+	}
+	return opts
+}
+
+func (v *MachineVM) prepare() error {
+	return nil
+}
+
+func (v *MachineVM) archRemovalFiles() []string {
+	return []string{}
+}
+
+func getQemuUefiFile(name string) string {
+	dirs := []string{
+		"/usr/share/qemu-efi-aarch64",
+		"/usr/share/edk2/aarch64",
+	}
+	for _, dir := range dirs {
+		if _, err := os.Stat(dir); err == nil {
+			return filepath.Join(dir, name)
+		}
+	}
+	return name
+}
diff --git a/test/apiv2/01-basic.at b/test/apiv2/01-basic.at
index a256d8327..64aafa013 100644
--- a/test/apiv2/01-basic.at
+++ b/test/apiv2/01-basic.at
@@ -16,13 +16,13 @@ t GET  libpod/_ping 200 OK
 t HEAD libpod/_ping 200
 
 for i in /version version; do
-    t GET  $i      200                           \
-      .Components[0].Name="Podman Engine"        \
-      .Components[0].Details.APIVersion=3.2.0-dev    \
-      .Components[0].Details.MinAPIVersion=3.1.0 \
-      .Components[0].Details.Os=linux            \
-      .ApiVersion=1.40                          \
-      .MinAPIVersion=1.24                       \
+    t GET  $i      200                               \
+      .Components[0].Name="Podman Engine"            \
+      .Components[0].Details.APIVersion~3[0-9.-]\\+  \
+      .Components[0].Details.MinAPIVersion=3.1.0     \
+      .Components[0].Details.Os=linux                \
+      .ApiVersion=1.40                               \
+      .MinAPIVersion=1.24                            \
       .Os=linux
 done