diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/source/markdown/links/podman-image-untag.1 | 1 | ||||
| -rw-r--r-- | docs/source/markdown/podman-build.1.md | 4 | ||||
| -rw-r--r-- | docs/source/markdown/podman-create.1.md | 19 | ||||
| -rw-r--r-- | docs/source/markdown/podman-exec.1.md | 14 | ||||
| -rw-r--r-- | docs/source/markdown/podman-generate-systemd.1.md | 5 | ||||
| -rw-r--r-- | docs/source/markdown/podman-history.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-image-trust.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-image.1.md | 1 | ||||
| -rw-r--r-- | docs/source/markdown/podman-info.1.md | 27 | ||||
| -rw-r--r-- | docs/source/markdown/podman-play-kube.1.md | 4 | ||||
| -rw-r--r-- | docs/source/markdown/podman-ps.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-run.1.md | 34 | ||||
| -rw-r--r-- | docs/source/markdown/podman-untag.1.md | 37 | ||||
| -rw-r--r-- | docs/source/markdown/podman.1.md | 3 |
14 files changed, 133 insertions, 22 deletions
diff --git a/docs/source/markdown/links/podman-image-untag.1 b/docs/source/markdown/links/podman-image-untag.1 new file mode 100644 index 000000000..3ec6a8a68 --- /dev/null +++ b/docs/source/markdown/links/podman-image-untag.1 @@ -0,0 +1 @@ +.so man1/podman-untag.1 diff --git a/docs/source/markdown/podman-build.1.md b/docs/source/markdown/podman-build.1.md index 6c8f239a6..fac8296ad 100644 --- a/docs/source/markdown/podman-build.1.md +++ b/docs/source/markdown/podman-build.1.md @@ -176,6 +176,10 @@ value can be entered. The password is entered without echo. Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm) +Note: if the user only has access rights via a group then accessing the device +from inside a rootless container will fail. The `crun` runtime offers a +workaround for this by adding the option `--annotation io.crun.keep_original_groups=1`. + **--disable-compression, -D** Don't compress filesystem layers when building the image unless it is required diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md index 82d2e8f6a..fdc2edf39 100644 --- a/docs/source/markdown/podman-create.1.md +++ b/docs/source/markdown/podman-create.1.md @@ -204,6 +204,10 @@ Specify the key sequence for detaching a container. Format is a single character Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm) +Note: if the user only has access rights via a group then accessing the device +from inside a rootless container will fail. The `crun` runtime offers a +workaround for this by adding the option `--annotation io.crun.keep_original_groups=1`. + **--device-read-bps**=*path* Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb) @@ -415,6 +419,17 @@ Logging driver specific options. Used to set the path to the container log file `--log-opt path=/var/log/container/mycontainer.json` +**--log-opt**=*tag* + +Set custom logging configuration. Presently supports the `tag` option +which specified a custom log tag for the container. For example: + +`--log-opt tag="{{.ImageName}}"` + +It supports the same keys as `podman inspect --format`. + +It is currently supported only by the journald log driver. + **--mac-address**=*address* Container MAC address (e.g. 92:d0:c6:0a:29:33) @@ -571,7 +586,7 @@ To make a pod with more granular options, use the `podman pod create` command be Give extended privileges to this container. The default is *false*. By default, Podman containers are -“unprivileged” (=false) and cannot, for example, modify parts of the kernel. +“unprivileged” (=false) and cannot, for example, modify parts of the operating system. This is because by default a container is not allowed to access any devices. A “privileged” container is given access to all devices. @@ -580,6 +595,8 @@ to all devices on the host, turns off graphdriver mount options, as well as turning off most of the security measures protecting the host from the container. +Rootless containers cannot have more privileges than the account that launched them. + **--publish**, **-p**=*port* Publish a container's port, or range of ports, to the host diff --git a/docs/source/markdown/podman-exec.1.md b/docs/source/markdown/podman-exec.1.md index d46427c91..fc67211d1 100644 --- a/docs/source/markdown/podman-exec.1.md +++ b/docs/source/markdown/podman-exec.1.md @@ -43,7 +43,19 @@ Pass down to the process N additional file descriptors (in addition to 0, 1, 2). **--privileged** -Give the process extended Linux capabilities when running the command in container. +Give extended privileges to this container. The default is *false*. + +By default, Podman containers are +"unprivileged" and cannot, for example, modify parts of the operating system. +This is because by default a container is only allowed limited access to devices. +A "privileged" container is given the same access to devices as the user launching the container. + +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read/only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. + +Rootless containers cannot have more privileges than the account that launched them. + **--tty**, **-t** diff --git a/docs/source/markdown/podman-generate-systemd.1.md b/docs/source/markdown/podman-generate-systemd.1.md index b81e68a46..4d3f9ba48 100644 --- a/docs/source/markdown/podman-generate-systemd.1.md +++ b/docs/source/markdown/podman-generate-systemd.1.md @@ -22,11 +22,16 @@ Generate files instead of printing to stdout. The generated files are named {co Use the name of the container for the start, stop, and description in the unit file +**--new** + +Create a new container via podman-run instead of starting an existing one. This option relies on container configuration files, which may not map directly to podman CLI flags; please review the generated output carefully before placing in production. + **--timeout**, **-t**=*value* Override the default stop timeout for the container with the given value. **--restart-policy**=*policy* + Set the systemd restart policy. The restart-policy must be one of: "no", "on-success", "on-failure", "on-abnormal", "on-watchdog", "on-abort", or "always". The default policy is *on-failure*. diff --git a/docs/source/markdown/podman-history.1.md b/docs/source/markdown/podman-history.1.md index a67cb0286..078864faa 100644 --- a/docs/source/markdown/podman-history.1.md +++ b/docs/source/markdown/podman-history.1.md @@ -22,7 +22,7 @@ Valid placeholders for the Go template are listed below: | **Placeholder** | **Description** | | --------------- | ----------------------------------------------------------------------------- | | .ID | Image ID | -| .Created | if **--human**, time elapsed since creation, otherwise time stamp of creation | +| .Created | if --human, time elapsed since creation, otherwise time stamp of creation | | .CreatedBy | Command used to create the layer | | .Size | Size of layer on disk | | .Comment | Comment for the layer | diff --git a/docs/source/markdown/podman-image-trust.1.md b/docs/source/markdown/podman-image-trust.1.md index 3fe4f7f52..435d117f1 100644 --- a/docs/source/markdown/podman-image-trust.1.md +++ b/docs/source/markdown/podman-image-trust.1.md @@ -86,7 +86,7 @@ Display trust as JSON ## SEE ALSO -policy-json(5) +containers-policy.json(5) ## HISTORY January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) diff --git a/docs/source/markdown/podman-image.1.md b/docs/source/markdown/podman-image.1.md index 339a531dd..1552098ac 100644 --- a/docs/source/markdown/podman-image.1.md +++ b/docs/source/markdown/podman-image.1.md @@ -27,6 +27,7 @@ The image command allows you to manage images | save | [podman-save(1)](podman-save.1.md) | Save an image to docker-archive or oci. | | sign | [podman-image-sign(1)](podman-image-sign.1.md) | Create a signature for an image. | | tag | [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | +| untag | [podman-untag(1)](podman-untag.1.md) | Removes one or more names from a locally-stored image. | | tree | [podman-image-tree(1)](podman-image-tree.1.md) | Prints layer hierarchy of an image in a tree format. | | trust | [podman-image-trust(1)](podman-image-trust.1.md)| Manage container registry image trust policy. | diff --git a/docs/source/markdown/podman-info.1.md b/docs/source/markdown/podman-info.1.md index 9721755ef..b539f1d3c 100644 --- a/docs/source/markdown/podman-info.1.md +++ b/docs/source/markdown/podman-info.1.md @@ -53,13 +53,26 @@ host: os: linux uptime: 218h 49m 33.66s (Approximately 9.08 days) registries: - blocked: null - insecure: null - search: - - quay.io - - registry.fedoraproject.org - - docker.io - - registry.redhat.io + docker.io: + Blocked: true + Insecure: true + Location: docker.io + MirrorByDigestOnly: false + Mirrors: + - Insecure: true + Location: example2.io/example/ubi8-minimal + Prefix: docker.io + redhat.com: + Blocked: false + Insecure: false + Location: registry.access.redhat.com/ubi8 + MirrorByDigestOnly: true + Mirrors: + - Insecure: false + Location: example.io/example/ubi8-minimal + - Insecure: true + Location: example3.io/example/ubi8-minimal + Prefix: redhat.com store: ConfigFile: /etc/containers/storage.conf ContainerStore: diff --git a/docs/source/markdown/podman-play-kube.1.md b/docs/source/markdown/podman-play-kube.1.md index 2ac860a32..2367ff7fe 100644 --- a/docs/source/markdown/podman-play-kube.1.md +++ b/docs/source/markdown/podman-play-kube.1.md @@ -40,6 +40,10 @@ value can be entered. The password is entered without echo. Suppress output information when pulling images +**--seccomp-profile-root**=*path* + +Directory path for seccomp profiles (default: "/var/lib/kubelet/seccomp"). (Not available for remote commands) + **--tls-verify**=*true|false* Require HTTPS and verify certificates when contacting registries (default: true). If explicitly set to true, diff --git a/docs/source/markdown/podman-ps.1.md b/docs/source/markdown/podman-ps.1.md index 298de0b2b..024b85ea5 100644 --- a/docs/source/markdown/podman-ps.1.md +++ b/docs/source/markdown/podman-ps.1.md @@ -105,7 +105,7 @@ Valid filters are listed below: | name | [Name] Container's name | | label | [Key] or [Key=Value] Label assigned to a container | | exited | [Int] Container's exit code | -| status | [Status] Container's status: *created*, *exited*, *paused*, *running*, *unknown* | +| status | [Status] Container's status: 'created', 'exited', 'paused', 'running', 'unknown' | | ancestor | [ImageName] Image or descendant used to create container | | before | [ID] or [Name] Containers created before this container | | since | [ID] or [Name] Containers created since this container | diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md index e1177cb34..d9fdd9650 100644 --- a/docs/source/markdown/podman-run.1.md +++ b/docs/source/markdown/podman-run.1.md @@ -210,6 +210,10 @@ Specify the key sequence for detaching a container. Format is a single character Add a host device to the container. The format is `<device-on-host>[:<device-on-container>][:<permissions>]` (e.g. --device=/dev/sdc:/dev/xvdc:rwm) +Note: if the user only has access rights via a group then accessing the device +from inside a rootless container will fail. The `crun` runtime offers a +workaround for this by adding the option `--annotation io.crun.keep_original_groups=1`. + **--device-read-bps**=*path* Limit read rate (bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb) @@ -422,10 +426,21 @@ Logging driver for the container. Currently available options are *k8s-file* an **--log-opt**=*path* -Logging driver specific options. Used to set the path to the container log file. For example: +Set custom logging configuration. Presently supports the `tag` option +which specified a custom log tag for the container. For example: `--log-opt path=/var/log/container/mycontainer.json` +**--log-opt**=*tag* + +Specify a custom log tag for the container. For example: + +`--log-opt tag="{{.ImageName}}"` + +It supports the same keys as `podman inspect --format`. + +It is currently supported only by the journald log driver. + **--mac-address**=*address* Container MAC address (e.g. `92:d0:c6:0a:29:33`) @@ -584,15 +599,16 @@ If a container is run with a pod, and the pod has an infra-container, the infra- Give extended privileges to this container. The default is *false*. -By default, Podman containers are “unprivileged” (=false) and cannot, -for example, modify parts of the kernel. This is because by default a -container is not allowed to access any devices. A “privileged” container -is given access to all devices. +By default, Podman containers are “unprivileged” (=false) and cannot, for +example, modify parts of the operating system. This is because by default a +container is only allowed limited access to devices. A "privileged" container +is given the same access to devices as the user launching the container. -When the operator executes **podman run --privileged**, Podman enables access -to all devices on the host, turns off graphdriver mount options, as well as -turning off most of the security measures protecting the host from the -container. +A privileged container turns off the security features that isolate the +container from the host. Dropped Capabilities, limited devices, read/only mount +points, Apparmor/SELinux separation, and Seccomp filters are all disabled. + +Rootless containers cannot have more privileges than the account that launched them. **--publish**, **-p**=*port* diff --git a/docs/source/markdown/podman-untag.1.md b/docs/source/markdown/podman-untag.1.md new file mode 100644 index 000000000..3a54283d6 --- /dev/null +++ b/docs/source/markdown/podman-untag.1.md @@ -0,0 +1,37 @@ +% podman-untag(1) + +## NAME +podman\-untag - Removes one or more names from a locally-stored image + +## SYNOPSIS +**podman untag** *image*[:*tag*] [*target-names*[:*tag*]] [*options*] + +**podman image untag** *image*[:*tag*] [target-names[:*tag*]] [*options*] + +## DESCRIPTION +Removes one or all names of an image. A name refers to the entire image name, +including the optional *tag* after the `:`. If no target image names are +specified, `untag` will remove all tags for the image at once. + +## OPTIONS + +**--help**, **-h** + +Print usage statement + +## EXAMPLES + +``` +$ podman untag 0e3bbc2 + +$ podman untag imageName:latest otherImageName:latest + +$ podman untag httpd myregistryhost:5000/fedora/httpd:v2 +``` + + +## SEE ALSO +podman(1) + +## HISTORY +December 2019, Originally compiled by Sascha Grunert <sgrunert@suse.com> diff --git a/docs/source/markdown/podman.1.md b/docs/source/markdown/podman.1.md index c62f54fbb..0c9ec3d1c 100644 --- a/docs/source/markdown/podman.1.md +++ b/docs/source/markdown/podman.1.md @@ -201,6 +201,7 @@ the exit codes follow the `chroot` standard, see below: | [podman-umount(1)](podman-umount.1.md) | Unmount a working container's root filesystem. | | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | | [podman-unshare(1)](podman-unshare.1.md) | Run a command inside of a modified user namespace. | +| [podman-untag(1)](podman-untag.1.md) | Removes one or more names from a locally-stored image. | | [podman-varlink(1)](podman-varlink.1.md) | Runs the varlink backend interface. | | [podman-version(1)](podman-version.1.md) | Display the Podman version information. | | [podman-volume(1)](podman-volume.1.md) | Simple management tool for volumes. | @@ -271,7 +272,7 @@ The Network File System (NFS) and other distributed file systems (for example: L For more information, please refer to the [Podman Troubleshooting Page](https://github.com/containers/libpod/blob/master/troubleshooting.md). ## SEE ALSO -`containers-mounts.conf(5)`, `containers-registries.conf(5)`, `containers-storage.conf(5)`, `buildah(1)`, `libpod.conf(5)`, `oci-hooks(5)`, `policy.json(5)`, `subuid(5)`, `subgid(5)`, `slirp4netns(1)` +`containers-mounts.conf(5)`, `containers-registries.conf(5)`, `containers-storage.conf(5)`, `buildah(1)`, `libpod.conf(5)`, `oci-hooks(5)`, `containers-policy.json(5)`, `subuid(5)`, `subgid(5)`, `slirp4netns(1)` ## HISTORY Dec 2016, Originally compiled by Dan Walsh <dwalsh@redhat.com> |