diff options
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/source/markdown/podman-cp.1.md | 30 | ||||
| -rw-r--r-- | docs/source/markdown/podman-create.1.md | 5 | ||||
| -rw-r--r-- | docs/source/markdown/podman-load.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-network-connect.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-network-create.1.md | 12 | ||||
| -rw-r--r-- | docs/source/markdown/podman-network-disconnect.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-network-inspect.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-network-ls.1.md | 41 | ||||
| -rw-r--r-- | docs/source/markdown/podman-network.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-pull.1.md | 5 | ||||
| -rw-r--r-- | docs/source/markdown/podman-run.1.md | 39 |
11 files changed, 114 insertions, 28 deletions
diff --git a/docs/source/markdown/podman-cp.1.md b/docs/source/markdown/podman-cp.1.md index 8f63c00ee..241a74c42 100644 --- a/docs/source/markdown/podman-cp.1.md +++ b/docs/source/markdown/podman-cp.1.md @@ -9,12 +9,12 @@ podman\-cp - Copy files/folders between a container and the local filesystem **podman container cp** [*options*] [*container*:]*src_path* [*container*:]*dest_path* ## DESCRIPTION -Copies the contents of **src_path** to the **dest_path**. You can copy from the container's filesystem to the local machine or the reverse, from the local filesystem to the container. -If - is specified for either the SRC_PATH or DEST_PATH, you can also stream a tar archive from STDIN or to STDOUT. +Copy the contents of **src_path** to the **dest_path**. You can copy from the container's filesystem to the local machine or the reverse, from the local filesystem to the container. +If `-` is specified for either the SRC_PATH or DEST_PATH, you can also stream a tar archive from STDIN or to STDOUT. The CONTAINER can be a running or stopped container. The **src_path** or **dest_path** can be a file or directory. -The **podman cp** command assumes container paths are relative to the container's / (root) directory. +The **podman cp** command assumes container paths are relative to the container's root directory (i.e., `/`). This means supplying the initial forward slash is optional; @@ -27,24 +27,22 @@ Assuming a path separator of /, a first argument of **src_path** and second argu **src_path** specifies a file - **dest_path** does not exist - - the file is saved to a file created at **dest_path** - - **dest_path** does not exist and ends with / - - Error condition: the destination directory must exist. + - the file is saved to a file created at **dest_path** (note that parent directory must exist) - **dest_path** exists and is a file - - the destination is overwritten with the source file's contents + - the destination is overwritten with the source file's contents - **dest_path** exists and is a directory - - the file is copied into this directory using the basename from **src_path** + - the file is copied into this directory using the basename from **src_path** **src_path** specifies a directory - **dest_path** does not exist - - **dest_path** is created as a directory and the contents of the source directory are copied into this directory + - **dest_path** is created as a directory and the contents of the source directory are copied into this directory - **dest_path** exists and is a file - - Error condition: cannot copy a directory to a file + - Error condition: cannot copy a directory to a file - **dest_path** exists and is a directory - - **src_path** ends with / - - the source directory is copied into this directory - - **src_path** ends with /. (that is: slash followed by dot) - - the content of the source directory is copied into this directory + - **src_path** ends with `/` + - the source directory is copied into this directory + - **src_path** ends with `/.` (i.e., slash followed by dot) + - the content of the source directory is copied into this directory The command requires **src_path** and **dest_path** to exist according to the above rules. @@ -57,11 +55,13 @@ You can also use : when specifying paths to a **src_path** or **dest_path** on a If you use a : in a local machine path, you must be explicit with a relative or absolute path, for example: `/path/to/file:name.txt` or `./file:name.txt` +Using `-` as the *src_path* streams the contents of STDIN as a tar archive. The command extracts the content of the tar to the *DEST_PATH* in the container. In this case, *dest_path* must specify a directory. Using `-` as the *dest_path* streams the contents of the resource (can be a directory) as a tar archive to STDOUT. + ## OPTIONS #### **--extract** -Extract the tar file into the destination directory. If the destination directory is not provided, extract the tar file into the root directory. +If the source is a tar archive, extract it to the provided destination (must be a directory). If the source is not a tar archive, follow the above rules. #### **--pause** diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md index ab390447e..843e2b22f 100644 --- a/docs/source/markdown/podman-create.1.md +++ b/docs/source/markdown/podman-create.1.md @@ -689,6 +689,11 @@ Default is to create a private PID namespace for the container Tune the container's pids limit. Set `0` to have unlimited pids for the container. (default "4096" on systems that support PIDS cgroups). +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with override-arch and override-os) +The `--platform` option can be used to override the current architecture and operating system. + #### **--pod**=*name* Run container in an existing pod. If you want Podman to make the pod for you, preference the pod name with `new:`. diff --git a/docs/source/markdown/podman-load.1.md b/docs/source/markdown/podman-load.1.md index 177709a43..dc2a632e5 100644 --- a/docs/source/markdown/podman-load.1.md +++ b/docs/source/markdown/podman-load.1.md @@ -10,7 +10,7 @@ podman\-load - Load image(s) from a tar archive into container storage ## DESCRIPTION **podman load** loads an image from either an **oci-archive** or a **docker-archive** stored on the local machine into container storage. **podman load** reads from stdin by default or a file if the **input** option is set. -You can also specify a name for the image if the archive does not contain a named reference, of if you want an additional name for the local image. +You can also specify a name for the image if the archive is of single image and load will tag an additional image with the name:tag. **podman load** is used for loading from the archive generated by **podman save**, that includes the image parent layers. To load the archive of container's filesystem created by **podman export**, use **podman import**. The local client further supports loading an **oci-dir** or a **docker-dir** as created with **podman save** (1). diff --git a/docs/source/markdown/podman-network-connect.1.md b/docs/source/markdown/podman-network-connect.1.md index 58b6e5c44..a31a415dc 100644 --- a/docs/source/markdown/podman-network-connect.1.md +++ b/docs/source/markdown/podman-network-connect.1.md @@ -10,6 +10,8 @@ podman\-network\-connect - Connect a container to a network Connects a container to a network. A container can be connected to a network by name or by ID. Once connected, the container can communicate with other containers in the same network. +This command is not available for rootless users. + ## OPTIONS #### **--alias** Add network-scoped alias for the container. If the network is using the `dnsname` CNI plugin, these aliases diff --git a/docs/source/markdown/podman-network-create.1.md b/docs/source/markdown/podman-network-create.1.md index cbf9d26dc..16e4e3bdb 100644 --- a/docs/source/markdown/podman-network-create.1.md +++ b/docs/source/markdown/podman-network-create.1.md @@ -26,6 +26,14 @@ resolution. Driver to manage the network (default "bridge"). Currently only `bridge` is supported. +#### **--opt**=*option*, **-o** + +Set driver specific options. + +For the `bridge` driver the following options are supported: `mtu` and `vlan`. +The `mtu` option sets the Maximum Transmission Unit (MTU) and takes an integer value. +The `vlan` option assign VLAN tag and enables vlan\_filtering. Defaults to none. + #### **--gateway** Define a gateway for the subnet. If you want to provide a gateway address, you must also provide a @@ -40,6 +48,10 @@ Restrict external access of this network Allocate container IP from a range. The range must be a complete subnet and in CIDR notation. The *ip-range* option must be used with a *subnet* option. +#### **--label** + +Set metadata for a network (e.g., --label mykey=value). + #### **--macvlan** Create a *Macvlan* based connection rather than a classic bridge. You must pass an interface name from the host for the diff --git a/docs/source/markdown/podman-network-disconnect.1.md b/docs/source/markdown/podman-network-disconnect.1.md index 95c7018a8..8b7125282 100644 --- a/docs/source/markdown/podman-network-disconnect.1.md +++ b/docs/source/markdown/podman-network-disconnect.1.md @@ -9,6 +9,8 @@ podman\-network\-disconnect - Disconnect a container from a network ## DESCRIPTION Disconnects a container from a network. +This command is not available for rootless users. + ## OPTIONS #### **--force**, **-f** diff --git a/docs/source/markdown/podman-network-inspect.1.md b/docs/source/markdown/podman-network-inspect.1.md index 47d647b3f..56515d0c1 100644 --- a/docs/source/markdown/podman-network-inspect.1.md +++ b/docs/source/markdown/podman-network-inspect.1.md @@ -7,7 +7,7 @@ podman\-network\-inspect - Displays the raw CNI network configuration for one or **podman network inspect** [*options*] [*network* ...] ## DESCRIPTION -Display the raw (JSON format) network configuration. This command is not available for rootless users. +Display the raw (JSON format) network configuration. ## OPTIONS #### **--format**, **-f** diff --git a/docs/source/markdown/podman-network-ls.1.md b/docs/source/markdown/podman-network-ls.1.md index 34b40b3ae..9d2dd52a8 100644 --- a/docs/source/markdown/podman-network-ls.1.md +++ b/docs/source/markdown/podman-network-ls.1.md @@ -7,20 +7,47 @@ podman\-network\-ls - Display a summary of CNI networks **podman network ls** [*options*] ## DESCRIPTION -Displays a list of existing podman networks. This command is not available for rootless users. +Displays a list of existing podman networks. ## OPTIONS -#### **--quiet**, **-q** +#### **--filter**, **-f** -The `quiet` option will restrict the output to only the network names. +Filter output based on conditions given. +Multiple filters can be given with multiple uses of the --filter flag. +Filters with the same key work inclusive with the only exception being +`label` which is exclusive. Filters with different keys always work exclusive. + +Valid filters are listed below: + +| **Filter** | **Description** | +| ---------- | ------------------------------------------------------------------------------------- | +| name | [Name] Network name (accepts regex) | +| id | [ID] Full or partial network ID | +| label | [Key] or [Key=Value] Label assigned to a network | +| plugin | [Plugin] CNI plugins included in a network (e.g `bridge`,`portmap`,`firewall`,`tuning`,`dnsname`,`macvlan`) | +| driver | [Driver] Only `bridge` is supported | + +#### **--format** -#### **--format**, **-f** +Change the default output format. This can be of a supported type like 'json' +or a Go template. +Valid placeholders for the Go template are listed below: -Pretty-print networks to JSON or using a Go template. +| **Placeholder** | **Description** | +| --------------- | --------------------------------| +| .ID | Network ID | +| .Name | Network name | +| .Plugins | Network Plugins | +| .Labels | Network labels | +| .Version | CNI Version of the config file | -#### **--filter** +#### **--no-trunc** -Provide filter values (e.g. 'name=podman'). +Do not truncate the network ID. The network ID is not displayed by default and must be specified with **--format**. + +#### **--quiet**, **-q** + +The `quiet` option will restrict the output to only the network names. ## EXAMPLE diff --git a/docs/source/markdown/podman-network.1.md b/docs/source/markdown/podman-network.1.md index d21b200d9..bc161659a 100644 --- a/docs/source/markdown/podman-network.1.md +++ b/docs/source/markdown/podman-network.1.md @@ -7,7 +7,7 @@ podman\-network - Manage Podman CNI networks **podman network** *subcommand* ## DESCRIPTION -The network command manages CNI networks for Podman. It is not supported for rootless users. +The network command manages CNI networks for Podman. ## COMMANDS diff --git a/docs/source/markdown/podman-pull.1.md b/docs/source/markdown/podman-pull.1.md index 4495cec3a..44a7e83b6 100644 --- a/docs/source/markdown/podman-pull.1.md +++ b/docs/source/markdown/podman-pull.1.md @@ -106,6 +106,11 @@ Override the OS, defaults to hosts, of the image to be pulled. For example, `win Use _VARIANT_ instead of the default architecture variant of the container image. Some images can use multiple variants of the arm architectures, such as arm/v5 and arm/v7. +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with override-arch and override-os) +The `--platform` option can be used to override the current architecture and operating system. + #### **--quiet**, **-q** Suppress output information when pulling images diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md index 13b586e17..53c5b2d4b 100644 --- a/docs/source/markdown/podman-run.1.md +++ b/docs/source/markdown/podman-run.1.md @@ -26,9 +26,12 @@ Several files will be automatically created within the container. These include _/etc/hosts_, _/etc/hostname_, and _/etc/resolv.conf_ to manage networking. These will be based on the host's version of the files, though they can be customized with options (for example, **--dns** will override the host's DNS -servers in the created _resolv.conf_). Additionally, an empty file is created in -each container to indicate to programs they are running in a container. This file -is located at _/run/.containerenv_. +servers in the created _resolv.conf_). Additionally, a container environment +file is created in each container to indicate to programs they are running in a +container. This file is located at _/run/.containerenv_. When using the +--privileged flag the .containerenv contains name/value pairs indicating the +container engine version, whether the engine is running in rootless mode, the +container name and id, as well as the image name and id that the container is based on. When running from a user defined network namespace, the _/etc/netns/NSNAME/resolv.conf_ will be used if it exists, otherwise _/etc/resolv.conf_ will be used. @@ -717,6 +720,11 @@ The efault is to create a private PID namespace for the container. Tune the container's pids limit. Set to **0** to have unlimited pids for the container. The default is **4096** on systems that support "pids" cgroup controller. +#### **--platform**=*OS/ARCH* + +Specify the platform for selecting the image. (Conflicts with override-arch and override-os) +The `--platform` option can be used to override the current architecture and operating system. + #### **--pod**=*name* Run container in an existing pod. If you want Podman to make the pod for you, prefix the pod name with **new:**. @@ -880,11 +888,16 @@ Security Options - **label=level:**_LEVEL_: Set the label level for the container processes - **label=filetype:**TYPE_: Set the label file type for the container files - **label=disable**: Turn off label separation for the container +- **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path + cannot be accessed inside the container. - **no-new-privileges**: Disable container processes from gaining additional privileges - **seccomp=unconfined**: Turn off seccomp confinement for the container - **seccomp**=_profile.json_: Allowed syscall list seccomp JSON file to be used as a seccomp filter - **proc-opts**=_OPTIONS_ : Comma separated list of options to use for the /proc mount. More details for the possible mount options are specified at **proc(5)** man page. +- **unmask**=_ALL_ or _/path/1:/path/2_: Paths to unmask separated by a colon. If set to **ALL**, it will + unmask all the paths that are masked by default. + The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.** Note: Labeling can be disabled for all containers by setting **label=false** in the **containers.conf**(5) file. @@ -1474,6 +1487,26 @@ $ podman run --security-opt label=type:svirt_apache_t -i -t centos bash Note you would have to write policy defining a **svirt_apache_t** type. +To mask additional specific paths in the container, specify the paths +separated by a colon using the **mask** option with the **--security-opt** +flag. + +``` +$ podman run --security-opt mask=/foo/bar:/second/path fedora bash +``` + +To unmask all the paths that are masked by default, set the **unmask** option to +**ALL**. Or to only unmask specific paths, specify the paths as shown above with +the **mask** option. + +``` +$ podman run --security-opt unmask=ALL fedora bash +``` + +``` +$ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash +``` + ### Setting device weight If you want to set _/dev/sda_ device weight to **200**, you can specify the device |