diff options
Diffstat (limited to 'docs/source/markdown')
| -rw-r--r-- | docs/source/markdown/podman-container-prune.1.md | 3 | ||||
| -rw-r--r-- | docs/source/markdown/podman-create.1.md | 17 | ||||
| -rw-r--r-- | docs/source/markdown/podman-exec.1.md | 14 | ||||
| -rw-r--r-- | docs/source/markdown/podman-generate-systemd.1.md | 5 | ||||
| -rw-r--r-- | docs/source/markdown/podman-inspect.1.md | 120 | ||||
| -rw-r--r-- | docs/source/markdown/podman-run.1.md | 32 |
6 files changed, 135 insertions, 56 deletions
diff --git a/docs/source/markdown/podman-container-prune.1.md b/docs/source/markdown/podman-container-prune.1.md index 856843a80..eaecee304 100644 --- a/docs/source/markdown/podman-container-prune.1.md +++ b/docs/source/markdown/podman-container-prune.1.md @@ -11,6 +11,9 @@ podman-container-prune - Remove all stopped containers from local storage ## OPTIONS +**--force**, **-f** +Do not provide an interactive prompt for container removal. + **-h**, **--help** Print usage statement diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md index 814805e19..81fae0b25 100644 --- a/docs/source/markdown/podman-create.1.md +++ b/docs/source/markdown/podman-create.1.md @@ -419,6 +419,17 @@ Logging driver specific options. Used to set the path to the container log file `--log-opt path=/var/log/container/mycontainer.json` +**--log-opt**=*tag* + +Set custom logging configuration. Presently supports the `tag` option +which specified a custom log tag for the container. For example: + +`--log-opt tag="{{.ImageName}}"` + +It supports the same keys as `podman inspect --format`. + +It is currently supported only by the journald log driver. + **--mac-address**=*address* Container MAC address (e.g. 92:d0:c6:0a:29:33) @@ -575,7 +586,7 @@ To make a pod with more granular options, use the `podman pod create` command be Give extended privileges to this container. The default is *false*. By default, Podman containers are -“unprivileged” (=false) and cannot, for example, modify parts of the kernel. +“unprivileged” (=false) and cannot, for example, modify parts of the operating system. This is because by default a container is not allowed to access any devices. A “privileged” container is given access to all devices. @@ -584,6 +595,8 @@ to all devices on the host, turns off graphdriver mount options, as well as turning off most of the security measures protecting the host from the container. +Rootless containers cannot have more privileges than the account that launched them. + **--publish**, **-p**=*port* Publish a container's port, or range of ports, to the host @@ -792,7 +805,7 @@ You can pass `host` to copy the current configuration from the host. Sets the username or UID used and optionally the groupname or GID for the specified command. -The followings examples are all valid: +The following examples are all valid: --user [user | user:group | uid | uid:gid | user:gid | uid:group ] Without this argument the command will be run as root in the container. diff --git a/docs/source/markdown/podman-exec.1.md b/docs/source/markdown/podman-exec.1.md index d46427c91..fc67211d1 100644 --- a/docs/source/markdown/podman-exec.1.md +++ b/docs/source/markdown/podman-exec.1.md @@ -43,7 +43,19 @@ Pass down to the process N additional file descriptors (in addition to 0, 1, 2). **--privileged** -Give the process extended Linux capabilities when running the command in container. +Give extended privileges to this container. The default is *false*. + +By default, Podman containers are +"unprivileged" and cannot, for example, modify parts of the operating system. +This is because by default a container is only allowed limited access to devices. +A "privileged" container is given the same access to devices as the user launching the container. + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read/only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. + +Rootless containers cannot have more privileges than the account that launched them. + **--tty**, **-t** diff --git a/docs/source/markdown/podman-generate-systemd.1.md b/docs/source/markdown/podman-generate-systemd.1.md index b81e68a46..4d3f9ba48 100644 --- a/docs/source/markdown/podman-generate-systemd.1.md +++ b/docs/source/markdown/podman-generate-systemd.1.md @@ -22,11 +22,16 @@ Generate files instead of printing to stdout. The generated files are named {co Use the name of the container for the start, stop, and description in the unit file +**--new** + +Create a new container via podman-run instead of starting an existing one. This option relies on container configuration files, which may not map directly to podman CLI flags; please review the generated output carefully before placing in production. + **--timeout**, **-t**=*value* Override the default stop timeout for the container with the given value. **--restart-policy**=*policy* + Set the systemd restart policy. The restart-policy must be one of: "no", "on-success", "on-failure", "on-abnormal", "on-watchdog", "on-abort", or "always". The default policy is *on-failure*. diff --git a/docs/source/markdown/podman-inspect.1.md b/docs/source/markdown/podman-inspect.1.md index f1630c713..ad4d0659e 100644 --- a/docs/source/markdown/podman-inspect.1.md +++ b/docs/source/markdown/podman-inspect.1.md @@ -43,49 +43,83 @@ Display the total file size if the type is a container ``` # podman inspect fedora -{ - "Id": "422dc563ca3260ad9ef5c47a1c246f5065d7f177ce51f4dd208efd82967ff182", - "Digest": "sha256:1b9bfb4e634dc1e5c19d0fa1eb2e5a28a5c2b498e3d3e4ac742bd7f5dae08611", - "RepoTags": [ - "docker.io/library/fedora:latest" - ], - "RepoDigests": [ - "docker.io/library/fedora@sha256:1b9bfb4e634dc1e5c19d0fa1eb2e5a28a5c2b498e3d3e4ac742bd7f5dae08611" - ], - "Parent": "", - "Comment": "", - "Created": "2017-11-14T21:07:08.475840838Z", - "Config": { - "Env": [ - "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", - "DISTTAG=f27container", - "FGC=f27", - "FBR=f27" - ] - }, - "Version": "17.06.2-ce", - "Author": "[Adam Miller \u003cmaxamillion@fedoraproject.org\u003e] [Patrick Uiterwijk \u003cpatrick@puiterwijk.org\u003e]", - "Architecture": "amd64", - "Os": "linux", - "Size": 251722732, - "VirtualSize": 514895140, - "GraphDriver": { - "Name": "overlay", - "Data": { - "MergedDir": "/var/lib/containers/storage/overlay/d32459d9ce237564fb93573b85cbc707600d43fbe5e46e8eeef22cad914bb516/merged", - "UpperDir": "/var/lib/containers/storage/overlay/d32459d9ce237564fb93573b85cbc707600d43fbe5e46e8eeef22cad914bb516/diff", - "WorkDir": "/var/lib/containers/storage/overlay/d32459d9ce237564fb93573b85cbc707600d43fbe5e46e8eeef22cad914bb516/work" - } - }, - "RootFS": { - "Type": "layers", - "Layers": [ - "sha256:d32459d9ce237564fb93573b85cbc707600d43fbe5e46e8eeef22cad914bb516" - ] - }, - "Labels": null, - "Annotations": {} -} +[ + { + "Id": "f0858ad3febdf45bb2e5501cb459affffacef081f79eaa436085c3b6d9bd46ca", + "Digest": "sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a", + "RepoTags": [ + "docker.io/library/fedora:latest" + ], + "RepoDigests": [ + "docker.io/library/fedora@sha256:8fa60b88e2a7eac8460b9c0104b877f1aa0cea7fbc03c701b7e545dacccfb433", + "docker.io/library/fedora@sha256:d4f7df6b691d61af6cee7328f82f1d8afdef63bc38f58516858ae3045083924a" + ], + "Parent": "", + "Comment": "", + "Created": "2019-10-29T03:23:37.695123423Z", + "Config": { + "Env": [ + "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", + "DISTTAG=f31-updates-candidatecontainer", + "FGC=f31-updates-candidate", + "FBR=f31-updates-candidate" + ], + "Cmd": [ + "/bin/bash" + ], + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + } + }, + "Version": "18.06.1-ce", + "Author": "", + "Architecture": "amd64", + "Os": "linux", + "Size": 201096840, + "VirtualSize": 201096840, + "GraphDriver": { + "Name": "overlay", + "Data": { + "UpperDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/diff", + "WorkDir": "/home/user/.local/share/containers/storage/overlay/2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9/work" + } + }, + "RootFS": { + "Type": "layers", + "Layers": [ + "sha256:2ae3cee18c8ef9e0d448649747dab81c4f1ca2714a8c4550eff49574cab262c9" + ] + }, + "Labels": { + "maintainer": "Clement Verna \u003ccverna@fedoraproject.org\u003e" + }, + "Annotations": {}, + "ManifestType": "application/vnd.docker.distribution.manifest.v2+json", + "User": "", + "History": [ + { + "created": "2019-01-16T21:21:55.569693599Z", + "created_by": "/bin/sh -c #(nop) LABEL maintainer=Clement Verna \u003ccverna@fedoraproject.org\u003e", + "empty_layer": true + }, + { + "created": "2019-09-27T21:21:07.784469821Z", + "created_by": "/bin/sh -c #(nop) ENV DISTTAG=f31-updates-candidatecontainer FGC=f31-updates-candidate FBR=f31-updates-candidate", + "empty_layer": true + }, + { + "created": "2019-10-29T03:23:37.355187998Z", + "created_by": "/bin/sh -c #(nop) ADD file:298f828afc880ccde9205fc4418435d5e696ad165e283f0530d0b1a74326d6dc in / " + }, + { + "created": "2019-10-29T03:23:37.695123423Z", + "created_by": "/bin/sh -c #(nop) CMD [\"/bin/bash\"]", + "empty_layer": true + } + ], + "NamesHistory": [] + } +] ``` ``` diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md index ceb97dbb7..af5bb814d 100644 --- a/docs/source/markdown/podman-run.1.md +++ b/docs/source/markdown/podman-run.1.md @@ -426,10 +426,21 @@ Logging driver for the container. Currently available options are *k8s-file* an **--log-opt**=*path* -Logging driver specific options. Used to set the path to the container log file. For example: +Set custom logging configuration. Presently supports the `tag` option +which specified a custom log tag for the container. For example: `--log-opt path=/var/log/container/mycontainer.json` +**--log-opt**=*tag* + +Specify a custom log tag for the container. For example: + +`--log-opt tag="{{.ImageName}}"` + +It supports the same keys as `podman inspect --format`. + +It is currently supported only by the journald log driver. + **--mac-address**=*address* Container MAC address (e.g. `92:d0:c6:0a:29:33`) @@ -588,15 +599,16 @@ If a container is run with a pod, and the pod has an infra-container, the infra- Give extended privileges to this container. The default is *false*. -By default, Podman containers are “unprivileged” (=false) and cannot, -for example, modify parts of the kernel. This is because by default a -container is not allowed to access any devices. A “privileged” container -is given access to all devices. +By default, Podman containers are “unprivileged” (=false) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container. -When the operator executes **podman run --privileged**, Podman enables access -to all devices on the host, turns off graphdriver mount options, as well as -turning off most of the security measures protecting the host from the -container. +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read/only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. + +Rootless containers cannot have more privileges than the account that launched them. **--publish**, **-p**=*port* @@ -829,7 +841,7 @@ You can pass `host` to copy the current configuration from the host. Sets the username or UID used and optionally the groupname or GID for the specified command. -The followings examples are all valid: +The following examples are all valid: --user [user | user:group | uid | uid:gid | user:gid | uid:group ] Without this argument the command will be run as root in the container. |