diff options
Diffstat (limited to 'docs/source/markdown/podman-run.1.md')
| -rw-r--r-- | docs/source/markdown/podman-run.1.md | 32 |
1 files changed, 29 insertions, 3 deletions
diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md index 56ca8fde0..0ab8f04db 100644 --- a/docs/source/markdown/podman-run.1.md +++ b/docs/source/markdown/podman-run.1.md @@ -939,8 +939,7 @@ Note: Labeling can be disabled for all containers by setting label=false in the - **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details for the possible mount options are specified in the **proc(5)** man page. -- **unmask**=_ALL_ or _/path/1:/path/2_: Paths to unmask separated by a colon. If set to **ALL**, it will - unmask all the paths that are masked or made read only by default. +- **unmask**=_ALL_ or _/path/1:/path/2_, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to **ALL**, it will unmask all the paths that are masked or made read only by default. The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.**. The default paths that are read only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. @@ -1029,6 +1028,12 @@ The **container_manage_cgroup** boolean must be enabled for this to be allowed o setsebool -P container_manage_cgroup true ``` +#### **\-\-timeout**=*seconds* + +Maximum time a container is allowed to run before conmon sends it the kill +signal. By default containers will run until they exit or are stopped by +`podman stop`. + #### **\-\-tmpfs**=*fs* Create a tmpfs mount. @@ -1643,6 +1648,13 @@ the **mask** option. $ podman run --security-opt unmask=ALL fedora bash ``` +To unmask all the paths that start with /proc, set the **unmask** option to +**/proc/***. + +``` +$ podman run --security-opt unmask=/proc/* fedora bash +``` + ``` $ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash ``` @@ -1768,6 +1780,20 @@ $ podman run --env ENV*****=b alpine printenv ENV***** b ``` +## CONMON + +When Podman starts a container it actually executes the conmon program, which +then executes the OCI Runtime. Conmon is the container monitor. It is a small +program whose job is to watch the primary process of the container, and if the +container dies, save the exit code. It also holds open the tty of the +container, so that it can be attached to later. This is what allows Podman to +run in detached mode (backgrounded), so Podman can exit but conmon continues to +run. Each container has their own instance of conmon. Conmon waits for the +container to exit, gathers and saves the exit code, and then launches a Podman +process to complete the container cleanup, by shutting down the network and +storage. For more information on conmon, please reference the conmon(8) man +page. + ## FILES **/etc/subuid** @@ -1778,7 +1804,7 @@ NOTE: Use the environment variable `TMPDIR` to change the temporary storage loca ## SEE ALSO **podman**(1), **podman-save**(1), **podman-ps**(1), **podman-attach**(1), **podman-pod-create**(1), **podman-port**(1), **podman-start**(1), **podman-kill**(1), **podman-stop**(1), -**podman-generate-systemd**(1) **podman-rm**(1), **subgid**(5), **subuid**(5), **containers.conf**(5), **systemd.unit**(5), **setsebool**(8), **slirp4netns**(1), **fuse-overlayfs**(1), **proc**(5)**. +**podman-generate-systemd**(1) **podman-rm**(1), **subgid**(5), **subuid**(5), **containers.conf**(5), **systemd.unit**(5), **setsebool**(8), **slirp4netns**(1), **fuse-overlayfs**(1), **proc**(5), **conmon**(8). ## HISTORY September 2018, updated by Kunal Kushwaha `<kushwaha_kunal_v7@lab.ntt.co.jp>` |