diff options
Diffstat (limited to 'docs')
46 files changed, 366 insertions, 77 deletions
diff --git a/docs/libpod.conf.5.md b/docs/libpod.conf.5.md index 98eb5bece..0836c45fa 100644 --- a/docs/libpod.conf.5.md +++ b/docs/libpod.conf.5.md @@ -12,8 +12,11 @@ libpod to manage containers. **image_default_transport**="" Default transport method for pulling and pushing images -**runtime_path**="" - Paths to search for a valid OCI runtime binary +**runtime**="" + Default OCI runtime to use if nothing is specified + +**runtimes** + For each OCI runtime, specify a list of paths to look for. The first one found is used. **conmon_path**="" Paths to search for the Conmon container manager binary @@ -79,6 +82,11 @@ libpod to manage containers. **label**="true|false" Indicates whether the containers should use label separation. +**num_locks**="" + Number of locks available for containers and pods. Each created container or pod consumes one lock. + The default number available is 2048. + If this is changed, a lock renumbering must be performed, using the `podman system renumber` command. + ## FILES `/usr/share/containers/libpod.conf`, default libpod configuration path diff --git a/docs/podman-attach.1.md b/docs/podman-attach.1.md index 4322ca2be..ceb945a0e 100644 --- a/docs/podman-attach.1.md +++ b/docs/podman-attach.1.md @@ -24,6 +24,8 @@ ctrl-[value] where [value] is one of: a-z, @, ^, [, , or _. Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--no-stdin** Do not attach STDIN. The default is false. diff --git a/docs/podman-build.1.md b/docs/podman-build.1.md index 76e16b42c..fdae48b93 100644 --- a/docs/podman-build.1.md +++ b/docs/podman-build.1.md @@ -362,6 +362,12 @@ Specifies the name which will be assigned to the resulting image if the build process completes successfully. If _imageName_ does not include a registry name, the registry name *localhost* will be prepended to the image name. +**--target** *stageName* + +Set the target build stage to build. When building a Dockerfile with multiple build stages, --target +can be used to specify an intermediate build stage by name as the final stage for the resulting image. +Commands after the target stage will be skipped. + **--tls-verify** *bool-value* Require HTTPS and verify certificates when talking to container registries (defaults to true). diff --git a/docs/podman-commit.1.md b/docs/podman-commit.1.md index 79e14aba6..acde51859 100644 --- a/docs/podman-commit.1.md +++ b/docs/podman-commit.1.md @@ -76,7 +76,7 @@ e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 ``` ``` -$ podman commit -q --pause=false reverent_golick image-commited +$ podman commit -q --pause=false containerID image-commited e3ce4d93051ceea088d1c242624d659be32cf1667ef62f1d16d6b60193e2c7a8 ``` diff --git a/docs/podman-container-checkpoint.1.md b/docs/podman-container-checkpoint.1.md index 94e52dc78..666dbbb80 100644 --- a/docs/podman-container-checkpoint.1.md +++ b/docs/podman-container-checkpoint.1.md @@ -25,6 +25,8 @@ Checkpoint all running containers. Instead of providing the container name or ID, checkpoint the last created container. +The latest option is not supported on the remote client. + **--leave-running, -R** Leave the container running after checkpointing instead of stopping it. diff --git a/docs/podman-container-cleanup.1.md b/docs/podman-container-cleanup.1.md index 2819d1138..2ad39d214 100644 --- a/docs/podman-container-cleanup.1.md +++ b/docs/podman-container-cleanup.1.md @@ -19,6 +19,9 @@ Cleanup all containers. **--latest, -l** Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. + +The latest option is not supported on the remote client. + ## EXAMPLE `podman container cleanup mywebserver` @@ -27,7 +30,7 @@ to run containers such as CRI-O, the last started container could be from either `podman container cleanup 860a4b23` -`podman container-cleanup -a` +`podman container cleanup -a` `podman container cleanup --latest` diff --git a/docs/podman-container-restore.1.md b/docs/podman-container-restore.1.md index 44219f3ef..e47d585cc 100644 --- a/docs/podman-container-restore.1.md +++ b/docs/podman-container-restore.1.md @@ -32,6 +32,8 @@ Restore all checkpointed containers. Instead of providing the container name or ID, restore the last created container. +The latest option is not supported on the remote client. + **--tcp-established** Restore a container with established TCP connections. If the checkpoint image diff --git a/docs/podman-cp.1.md b/docs/podman-cp.1.md index 88e50e86b..37426b236 100644 --- a/docs/podman-cp.1.md +++ b/docs/podman-cp.1.md @@ -3,20 +3,70 @@ ## NAME podman\-cp - Copy files/folders between a container and the local filesystem -## Description -We chose not to implement the `cp` feature in `podman` even though the upstream Docker -project has it. We have a much stronger capability. Using standard podman-mount -and podman-umount, we can take advantage of the entire linux tool chain, rather +## SYNOPSIS +**podman cp [CONTAINER:]SRC_PATH [CONTAINER:]DEST_PATH** + +## DESCRIPTION +Copies the contents of **SRC_PATH** to the **DEST_PATH**. You can copy from the containers's filesystem to the local machine or the reverse, from the local filesystem to the container. + +The CONTAINER can be a running or stopped container. The **SRC_PATH** or **DEST_PATH** can be a file or directory. + +The **podman cp** command assumes container paths are relative to the container's / (root) directory. + +This means supplying the initial forward slash is optional; + +The command sees **compassionate_darwin:/tmp/foo/myfile.txt** and **compassionate_darwin:tmp/foo/myfile.txt** as identical. + +Local machine paths can be an absolute or relative value. +The command interprets a local machine's relative paths as relative to the current working directory where **podman cp** is run. + +Assuming a path separator of /, a first argument of **SRC_PATH** and second argument of **DEST_PATH**, the behavior is as follows: + +**SRC_PATH** specifies a file + - **DEST_PATH** does not exist + - the file is saved to a file created at **DEST_PATH** + - **DEST_PATH** does not exist and ends with / + - **DEST_PATH** is created as a directory and the file is copied into this directory using the basename from **SRC_PATH** + - **DEST_PATH** exists and is a file + - the destination is overwritten with the source file's contents + - **DEST_PATH** exists and is a directory + - the file is copied into this directory using the basename from **SRC_PATH** + +**SRC_PATH** specifies a directory + - **DEST_PATH** does not exist + - **DEST_PATH** is created as a directory and the contents of the source directory are copied into this directory + - **DEST_PATH** exists and is a file + - Error condition: cannot copy a directory to a file + - **DEST_PATH** exists and is a directory + - **SRC_PATH** ends with / + - the source directory is copied into this directory + - **SRC_PATH** ends with /. (that is: slash followed by dot) + - the content of the source directory is copied into this directory + +The command requires **SRC_PATH** and **DEST_PATH** to exist according to the above rules. + +If **SRC_PATH** is local and is a symbolic link, the symbolic target, is copied by default. + +A colon (:) is used as a delimiter between CONTAINER and its path. + +You can also use : when specifying paths to a **SRC_PATH** or **DEST_PATH** on a local machine, for example, `file:name.txt`. + +If you use a : in a local machine path, you must be explicit with a relative or absolute path, for example: + `/path/to/file:name.txt` or `./file:name.txt` + + +## ALTERNATIVES + +Podman has much stronger capabilities than just `podman cp` to achieve copy files between host and container. + +Using standard podman-mount and podman-umount takes advantage of the entire linux tool chain, rather then just cp. -If a user wants to copy contents out of a container or into a container, they -can execute a few simple commands. +If a user wants to copy contents out of a container or into a container, they can execute a few simple commands. -You can copy from the container's file system to the local machine or the -reverse, from the local filesystem to the container. +You can copy from the container's file system to the local machine or the reverse, from the local filesystem to the container. -If you want to copy the /etc/foobar directory out of a container and onto /tmp -on the host, you could execute the following commands: +If you want to copy the /etc/foobar directory out of a container and onto /tmp on the host, you could execute the following commands: mnt=$(podman mount CONTAINERID) cp -R ${mnt}/etc/foobar /tmp @@ -40,5 +90,15 @@ This shows that using `podman mount` and `podman umount` you can use all of the standard linux tools for moving files into and out of containers, not just the cp command. +## EXAMPLE + +podman cp /myapp/app.conf containerID:/myapp/app.conf + +podman cp /home/myuser/myfiles.tar containerID:/tmp + +podman cp containerID:/myapp/ /myapp/ + +podman cp containerID:/home/myuser/. /home/myuser/ + ## SEE ALSO podman(1), podman-mount(1), podman-umount(1) diff --git a/docs/podman-create.1.md b/docs/podman-create.1.md index 98b1a2a17..342ef59c3 100644 --- a/docs/podman-create.1.md +++ b/docs/podman-create.1.md @@ -657,18 +657,21 @@ The followings examples are all valid: Without this argument the command will be run as root in the container. -**--userns**="" +**--userns**=host +**--userns**=ns:my_namespace -Set the usernamespace mode for the container. The use of userns is disabled by default. +Set the user namespace mode for the container. The use of userns is disabled by default. - **host**: use the host usernamespace and enable all privileged options (e.g., `pid=host` or `--privileged`). - **ns**: specify the usernamespace to use. +- `host`: run in the user namespace of the caller. This is the default if no user namespace options are set. The processes running in the container will have the same privileges on the host as any other process launched by the calling user. +- `ns`: run the container in the given existing user namespace. + +This option is incompatible with --gidmap, --uidmap, --subuid and --subgid **--uts**=*host* Set the UTS mode for the container **host**: use the host's UTS namespace inside the container. - **ns**: specify the usernamespace to use. + **ns**: specify the user namespace to use. Note: the host mode gives the container access to changing the host's hostname and is therefore considered insecure. **--volume**, **-v**[=*[HOST-DIR:CONTAINER-DIR[:OPTIONS]]*] @@ -780,10 +783,28 @@ can override the working directory by using the **-w** option. ## EXAMPLES +### Create a container using a local image + +``` +$ podman create alpine ls +``` + +### Create a container using a local image and annotate it + +``` +$ podman create --annotation HELLO=WORLD alpine ls +``` + +### Create a container using a local image, allocating a pseudo-TTY, keeping stdin open and name it myctr + +``` + podman create -t -i --name myctr alpine ls +``` + ### Set UID/GID mapping in a new user namespace -If you want to run the container in a new user namespace and define the mapping of -the uid and gid from the host. +Running a container in a new user namespace requires a mapping of +the uids and gids from the host. ``` $ podman create --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello @@ -804,13 +825,27 @@ KillMode=process WantedBy=multi-user.target ``` +### Rootless Containers + +Podman runs as a non root user on most systems. This feature requires that a new enough version of shadow-utils +be installed. The shadow-utils package must include the newuidmap and newgidmap executables. + +Note: RHEL7 and Centos 7 will not have this feature until RHEL7.7 is released. + +In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace. + +Rootless podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The fuse-overlay package provides a userspace overlay storage driver, otherwise users need to use +the vfs storage driver, which is diskspace expensive and does not perform well. slirp4netns is +required for VPN, without it containers need to be run with the --net=host flag. + ## FILES **/etc/subuid** **/etc/subgid** ## SEE ALSO -subgid(5), subuid(5), libpod.conf(5), systemd.unit(5), setsebool(8) +subgid(5), subuid(5), libpod.conf(5), systemd.unit(5), setsebool(8), slirp4netns(1), fuse-overlayfs(1) ## HISTORY October 2017, converted from Docker documentation to podman by Dan Walsh for podman <dwalsh@redhat.com> diff --git a/docs/podman-diff.1.md b/docs/podman-diff.1.md index dd5f0edcf..8837b744f 100644 --- a/docs/podman-diff.1.md +++ b/docs/podman-diff.1.md @@ -15,6 +15,12 @@ Displays changes on a container or image's filesystem. The container or image w Alter the output into a different format. The only valid format for diff is `json`. +**--latest, -l** + +Instead of providing the container name or ID, use the last created container. If you use methods other than Podman +to run containers such as CRI-O, the last started container could be from either of those methods. + +The latest option is not supported on the remote client. ## EXAMPLE diff --git a/docs/podman-exec.1.md b/docs/podman-exec.1.md index 77317b0ca..14088b468 100644 --- a/docs/podman-exec.1.md +++ b/docs/podman-exec.1.md @@ -4,7 +4,7 @@ podman\-exec - Execute a command in a running container ## SYNOPSIS -**podman exec** *container* [*options*] [*command* [*arg* ...]] +**podman exec** [*options*] *container* [*command* [*arg* ...]] ## DESCRIPTION **podman exec** executes a command in a running container. @@ -24,6 +24,8 @@ Not supported. All exec commands are interactive by default. Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--privileged** Give the process extended Linux capabilities when running the command in container. @@ -46,6 +48,12 @@ The default working directory for running binaries within a container is the roo The image developer can set a different default with the WORKDIR instruction, which can be overridden when creating the container. +## EXAMPLES + +$ podman exec -it ctrID ls +$ podman exec -it -w /tmp myCtr pwd +$ podman exec --user root ctrID ls + ## SEE ALSO podman(1), podman-run(1) diff --git a/docs/podman-generate-kube.1.md b/docs/podman-generate-kube.1.md index 5236f23fe..d4bed8ab1 100644 --- a/docs/podman-generate-kube.1.md +++ b/docs/podman-generate-kube.1.md @@ -19,6 +19,8 @@ The **service** option can be used to generate a Service specification for the c if the object has portmap bindings, the service specification will include a NodePort declaration to expose the service. A random port is assigned by Podman in the specification. +Note that the generated Kubernetes YAML file can be used to re-run the deployment via podman-play-kube(1). + # OPTIONS: **s** **--service** @@ -145,7 +147,7 @@ status: ``` ## SEE ALSO -podman(1), podman-container, podman-pod, podman-play +podman(1), podman-container(1), podman-pod(1), podman-play-kube(1) # HISTORY Decemeber 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/docs/podman-image-trust.1.md b/docs/podman-image-trust.1.md index 668fee0f3..819035040 100644 --- a/docs/podman-image-trust.1.md +++ b/docs/podman-image-trust.1.md @@ -14,19 +14,29 @@ podman\-trust - Manage container registry image trust policy REGISTRY[/REPOSITORY] # DESCRIPTION -Manages which registries you trust as a source of container images based on its location. The location is determined by the transport and the registry host of the image. Using this container image `docker://docker.io/library/busybox` as an example, `docker` is the transport and `docker.io` is the registry host. +Manages which registries you trust as a source of container images based on its location. The location is determined +by the transport and the registry host of the image. Using this container image `docker://docker.io/library/busybox` +as an example, `docker` is the transport and `docker.io` is the registry host. -The trust policy describes a registry scope (registry and/or repository). This trust can use public keys for signed images. +Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull +a remote image from a registry. The trust policy in policy.json describes a registry scope (registry and/or repository) for the trust. This trust can use public keys for signed images. -Trust is defined in **/etc/containers/policy.json** and is enforced when a user attempts to pull an image from a registry that is managed by policy.json. +The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be defined for an entire registry. Or it could be defined for a particular repository in that registry. Or it could be defined down to a specific signed image inside of the registry. -The scope of the trust is evaluated from most specific to the least specific. In other words, a policy may be defined for an entire registry. Or it could be defined for a particular repository in that registry. Or it could be defined down to a specific signed image inside of the registry. See below for examples. +For example, the following list includes valid scope values that could be used in policy.json from most specific to the least specific: + +docker.io/library/busybox:notlatest +docker.io/library/busybox +docker.io/library +docker.io + +If no configuration is found for any of these scopes, the default value (specified by using "default" instead of REGISTRY[/REPOSITORY]) is used. Trust **type** provides a way to: Whitelist ("accept") or -Blacklist ("reject") registries. - +Blacklist ("reject") registries or +Require signature (“signedBy”). Trust may be updated using the command **podman image trust set** for an existing trust scope. @@ -36,10 +46,8 @@ Trust may be updated using the command **podman image trust set** for an existin **-f** **--pubkeysfile** A path to an exported public key on the local system. Key paths - will be referenced in policy.json. Any path may be used but the path - **/etc/pki/containers** is recommended. Options may be used multiple times to - require an image be signed by multiple keys. One of **--pubkeys** or - **--pubkeysfile** is required for the **signedBy** type. + will be referenced in policy.json. Any path to a file may be used but locating the file in **/etc/pki/containers** is recommended. Options may be used multiple times to + require an image be signed by multiple keys. The **--pubkeysfile** option is required for the **signedBy** type. **-t** **--type** The trust type for this policy entry. Accepted values: @@ -84,7 +92,5 @@ Display trust as JSON policy-json(5) # HISTORY - January 2019, updated by Tom Sweeney (tsweeney at redhat dot com) - December 2018, originally compiled by Qi Wang (qiwan at redhat dot com) diff --git a/docs/podman-inspect.1.md b/docs/podman-inspect.1.md index b01bc0f4e..5748f29f4 100644 --- a/docs/podman-inspect.1.md +++ b/docs/podman-inspect.1.md @@ -27,6 +27,8 @@ The keys of the returned JSON can be used as the values for the --format flag (s Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--size, -s** Display the total file size if the type is a container diff --git a/docs/podman-kill.1.md b/docs/podman-kill.1.md index 85f68a73d..1c14b71d5 100644 --- a/docs/podman-kill.1.md +++ b/docs/podman-kill.1.md @@ -19,6 +19,8 @@ Signal all running containers. This does not include paused containers. Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--signal, s** Signal to send to the container. For more information on Linux signals, refer to *man signal(7)*. diff --git a/docs/podman-load.1.md b/docs/podman-load.1.md index eca7ecb2e..8b6501a5c 100644 --- a/docs/podman-load.1.md +++ b/docs/podman-load.1.md @@ -22,7 +22,9 @@ Note: `:` is a restricted character and cannot be part of the file name. **--input, -i** -Read from archive file, default is STDIN +Read from archive file, default is STDIN. + +The remote client requires the use of this option. **--quiet, -q** diff --git a/docs/podman-login.1.md b/docs/podman-login.1.md index e72d1deca..3ac0e30ef 100644 --- a/docs/podman-login.1.md +++ b/docs/podman-login.1.md @@ -25,6 +25,10 @@ flag. The default path used is **${XDG\_RUNTIME_DIR}/containers/auth.json**. Password for registry +**--password-stdin** + +Take the password from stdin + **--username, -u** Username for registry @@ -86,6 +90,16 @@ $ podman login --cert-dir /etc/containers/certs.d/ -u foo -p bar localhost:5000 Login Succeeded! ``` +``` +$ podman login -u testuser --password-stdin < testpassword.txt docker.io +Login Succeeded! +``` + +``` +$ echo $testpassword | podman login -u testuser --password-stdin docker.io +Login Succeeded! +``` + ## SEE ALSO podman(1), podman-logout(1), crio(8) diff --git a/docs/podman-logs.1.md b/docs/podman-logs.1.md index 71a798bc0..bc02df954 100644 --- a/docs/podman-logs.1.md +++ b/docs/podman-logs.1.md @@ -17,6 +17,13 @@ any logs at the time you execute podman logs Follow log output. Default is false +**--latest, -l** + +Instead of providing the container name or ID, use the last created container. If you use methods other than Podman +to run containers such as CRI-O, the last started container could be from either of those methods. + +The latest option is not supported on the remote client. + **--since=TIMESTAMP** Show logs since TIMESTAMP. The --since option can be Unix timestamps, date formatted timestamps, or Go duration @@ -61,7 +68,7 @@ podman logs --tail 2 b3f2436bdb97 To view a containers logs since a certain time: ``` -podman logs 224c375f27cd --since 2017-08-07T10:10:09.055837383-04:00 myserver +podman logs --since 2017-08-07T10:10:09.055837383-04:00 myserver 1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. 1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. @@ -72,7 +79,7 @@ podman logs 224c375f27cd --since 2017-08-07T10:10:09.055837383-04:00 myserver To view a container's logs generated in the last 10 minutes: ``` -podman logs 224c375f27cd --since 10m myserver +podman logs --since 10m myserver 1:M 07 Aug 14:10:09.055 # Server can't set maximum open files to 10032 because of OS error: Operation not permitted. 1:M 07 Aug 14:10:09.055 # Current maximum open files is 4096. maxclients has been reduced to 4064 to compensate for low ulimit. If you need higher maxclients increase 'ulimit -n'. diff --git a/docs/podman-mount.1.md b/docs/podman-mount.1.md index 2cccf5ee0..e244e5daf 100644 --- a/docs/podman-mount.1.md +++ b/docs/podman-mount.1.md @@ -33,6 +33,8 @@ Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--notruncate** Do not truncate IDs in output. diff --git a/docs/podman-play-kube.1.md b/docs/podman-play-kube.1.md index 3fd9746a5..2264f7a88 100644 --- a/docs/podman-play-kube.1.md +++ b/docs/podman-play-kube.1.md @@ -20,7 +20,7 @@ kubernetes_input.yml the pod and containers described in the YAML. The containers within the pod are then started and the ID of the new Pod is output. -Ideally the input file would be one created by Podman. This would guarantee a smooth import and expected results. +Ideally the input file would be one created by Podman (see podman-generate-kube(1)). This would guarantee a smooth import and expected results. # OPTIONS: @@ -72,7 +72,7 @@ $ podman play kube demo.yml ``` ## SEE ALSO -podman(1), podman-container(1), podman-pod(1), podman-generate(1), podman-play(1) +podman(1), podman-container(1), podman-pod(1), podman-generate-kube(1), podman-play(1) # HISTORY Decemeber 2018, Originally compiled by Brent Baude (bbaude at redhat dot com) diff --git a/docs/podman-pod-create.1.md b/docs/podman-pod-create.1.md index a63b12d73..06f962849 100644 --- a/docs/podman-pod-create.1.md +++ b/docs/podman-pod-create.1.md @@ -10,8 +10,8 @@ podman\-pod\-create - Create a new pod Creates an empty pod, or unit of multiple containers, and prepares it to have containers added to it. The pod id is printed to STDOUT. You can then use -**podman create --pod <pod_id|pod_name> ...** to add containers to the pod, and -**podman pod start <pod_id|pod_name>** to start the pod. +**podman create --pod \<pod_id|pod_name\> ...** to add containers to the pod, and +**podman pod start \<pod_id|pod_name\>** to start the pod. ## OPTIONS diff --git a/docs/podman-pod-inspect.1.md b/docs/podman-pod-inspect.1.md index b8fb143ba..a4e6a5559 100644 --- a/docs/podman-pod-inspect.1.md +++ b/docs/podman-pod-inspect.1.md @@ -16,6 +16,7 @@ that belong to the pod. Instead of providing the pod name or ID, use the last created pod. If you use methods other than Podman to run pods such as CRI-O, the last started pod could be from either of those methods. +The latest option is not supported on the remote client. ## EXAMPLE ``` diff --git a/docs/podman-pod-kill.1.md b/docs/podman-pod-kill.1.md index 4376c2d29..2a863d3d9 100644 --- a/docs/podman-pod-kill.1.md +++ b/docs/podman-pod-kill.1.md @@ -19,6 +19,8 @@ Sends signal to all containers associated with a pod. Instead of providing the pod name or ID, use the last created pod. If you use methods other than Podman to run pods such as CRI-O, the last started pod could be from either of those methods. +The latest option is not supported on the remote client. + **--signal, s** Signal to send to the containers in the pod. For more information on Linux signals, refer to *man signal(7)*. diff --git a/docs/podman-pod-pause.1.md b/docs/podman-pod-pause.1.md index 32c5b927e..418a9ee2a 100644 --- a/docs/podman-pod-pause.1.md +++ b/docs/podman-pod-pause.1.md @@ -19,6 +19,8 @@ Pause all pods. Instead of providing the pod name or ID, pause the last created pod. +The latest option is not supported on the remote client. + ## EXAMPLE podman pod pause mywebserverpod diff --git a/docs/podman-pod-ps.1.md b/docs/podman-pod-ps.1.md index 24b343438..ee215154a 100644 --- a/docs/podman-pod-ps.1.md +++ b/docs/podman-pod-ps.1.md @@ -42,6 +42,8 @@ Includes the container statuses in the container info field Show the latest pod created (all states) +The latest option is not supported on the remote client. + **--no-trunc** Display the extended information diff --git a/docs/podman-pod-restart.1.md b/docs/podman-pod-restart.1.md index 17fb4ed4c..cd6e5c8ce 100644 --- a/docs/podman-pod-restart.1.md +++ b/docs/podman-pod-restart.1.md @@ -22,8 +22,11 @@ Restarts all pods Instead of providing the pod name or ID, restart the last created pod. +The latest option is not supported on the remote client. + ## EXAMPLE +``` podman pod restart mywebserverpod cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 @@ -31,8 +34,6 @@ podman pod restart 490eb 3557fb 490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab -3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab - podman pod restart --latest 3557fbea6ad61569de0506fe037479bd9896603c31d3069a6677f23833916fab @@ -42,6 +43,7 @@ podman pod restart --all 490eb241aaf704d4dd2629904410fe4aa31965d9310a735f8755267f4ded1de5 70c358daecf71ef9be8f62404f926080ca0133277ef7ce4f6aa2d5af6bb2d3e9 cc8f0bea67b1a1a11aec1ecd38102a1be4b145577f21fc843c7c83b77fc28907 +``` ## SEE ALSO podman-pod(1), podman-pod-start(1), podman-restart(1) diff --git a/docs/podman-pod-rm.1.md b/docs/podman-pod-rm.1.md index 7a300c152..aa26a1bbb 100644 --- a/docs/podman-pod-rm.1.md +++ b/docs/podman-pod-rm.1.md @@ -19,6 +19,8 @@ Remove all pods. Can be used in conjunction with \-f as well. Instead of providing the pod name or ID, remove the last created pod. +The latest option is not supported on the remote client. + **--force, f** Stop running containers and delete all stopped containers before removal of pod. diff --git a/docs/podman-pod-start.1.md b/docs/podman-pod-start.1.md index 253bb5f53..27e40740f 100644 --- a/docs/podman-pod-start.1.md +++ b/docs/podman-pod-start.1.md @@ -20,6 +20,8 @@ Starts all pods Instead of providing the pod name or ID, start the last created pod. +The latest option is not supported on the remote client. + ## EXAMPLE podman pod start mywebserverpod diff --git a/docs/podman-pod-stop.1.md b/docs/podman-pod-stop.1.md index 7544f8bf7..338e04d67 100644 --- a/docs/podman-pod-stop.1.md +++ b/docs/podman-pod-stop.1.md @@ -19,6 +19,8 @@ Stops all pods Instead of providing the pod name or ID, stop the last created pod. +The latest option is not supported on the remote client. + **--timeout, --time, t** Timeout to wait before forcibly stopping the containers in the pod. diff --git a/docs/podman-pod-top.1.md b/docs/podman-pod-top.1.md index 0b330eb03..a77ca2b37 100644 --- a/docs/podman-pod-top.1.md +++ b/docs/podman-pod-top.1.md @@ -19,6 +19,8 @@ Display the running process of containers in a pod. The *format-descriptors* are Instead of providing the pod name or ID, use the last created pod. +The latest option is not supported on the remote client. + ## FORMAT DESCRIPTORS The following descriptors are supported in addition to the AIX format descriptors mentioned in ps (1): diff --git a/docs/podman-pod-unpause.1.md b/docs/podman-pod-unpause.1.md index 643544ef1..1004e09f9 100644 --- a/docs/podman-pod-unpause.1.md +++ b/docs/podman-pod-unpause.1.md @@ -19,6 +19,8 @@ Unpause all pods. Instead of providing the pod name or ID, unpause the last created pod. +The latest option is not supported on the remote client. + ## EXAMPLE podman pod unpause mywebserverpod diff --git a/docs/podman-port.1.md b/docs/podman-port.1.md index 874ea5036..020a25d32 100644 --- a/docs/podman-port.1.md +++ b/docs/podman-port.1.md @@ -21,11 +21,13 @@ or private ports/protocols as filters. Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + ## EXAMPLE List all port mappings ``` -#podman port -a +# podman port -a b4d2f05432e482e017b1a4b2eae15fa7b4f6fb7e9f65c1bde46294fdef285906 80/udp -> 0.0.0.0:44327 80/tcp -> 0.0.0.0:44327 @@ -34,21 +36,21 @@ b4d2f05432e482e017b1a4b2eae15fa7b4f6fb7e9f65c1bde46294fdef285906 List port mappings for a specific container ``` -#podman port b4d2f054 +# podman port b4d2f054 80/udp -> 0.0.0.0:44327 80/tcp -> 0.0.0.0:44327 # ``` List the port mappings for the latest container and port 80 ``` -#podman port b4d2f054 80 +# podman port b4d2f054 80 0.0.0.0:44327 # ``` List the port mappings for a specific container for port 80 and the tcp protocol. ``` -#podman port b4d2f054 80/tcp +# podman port b4d2f054 80/tcp 0.0.0.0:44327 # ``` diff --git a/docs/podman-ps.1.md b/docs/podman-ps.1.md index 8b86703d8..b8b1c3d62 100644 --- a/docs/podman-ps.1.md +++ b/docs/podman-ps.1.md @@ -75,6 +75,8 @@ Print the n last created containers (all states) Show the latest container created (all states) +The latest option is not supported on the remote client. + **--namespace, --ns** Display namespace information diff --git a/docs/podman-pull.1.md b/docs/podman-pull.1.md index 2196e251e..bce11b096 100644 --- a/docs/podman-pull.1.md +++ b/docs/podman-pull.1.md @@ -45,6 +45,10 @@ Image stored in local container/storage ## OPTIONS +**--all-tags, a** + +All tagged images in the repository will be pulled. + **--authfile** Path of the authentication file. Default is ${XDG_RUNTIME\_DIR}/containers/auth.json, which is set using `podman login`. diff --git a/docs/podman-restart.1.md b/docs/podman-restart.1.md index 875afa385..dd28e34c7 100644 --- a/docs/podman-restart.1.md +++ b/docs/podman-restart.1.md @@ -19,6 +19,8 @@ Restart all containers regardless of their current state. Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--running** Restart all containers that are already in the *running* state. diff --git a/docs/podman-rm.1.md b/docs/podman-rm.1.md index 4fcb0b6c5..dc1729188 100644 --- a/docs/podman-rm.1.md +++ b/docs/podman-rm.1.md @@ -1,9 +1,11 @@ -% podman-rm(1) +% podman-container-rm(1) ## NAME -podman\-rm - Remove one or more containers +podman\-container\-rm (podman\-rm) - Remove one or more containers ## SYNOPSIS +**podman container rm** [*options*] *container* + **podman rm** [*options*] *container* ## DESCRIPTION @@ -17,13 +19,17 @@ Remove all containers. Can be used in conjunction with -f as well. **--force, f** -Force the removal of a running and paused containers +Force the removal of running and paused containers. Forcing a containers removal also +removes containers from container storage even if the container is not known to podman. +Containers could have been created by a different container engine. **--latest, -l** Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--volumes, -v** Remove the volumes associated with the container. (Not yet implemented) @@ -53,8 +59,13 @@ Forcibly remove the latest container created. podman rm -f --latest ``` +## Exit Status +**_0_** if all specified containers removed +**_1_** if one of the specified containers did not exist, and no other failures +**_125_** if command fails for a reason other then an container did not exist + ## SEE ALSO -podman(1), podman-rmi(1) +podman(1), podman-image-rm(1) ## HISTORY August 2017, Originally compiled by Ryan Cole <rycole@redhat.com> diff --git a/docs/podman-rmi.1.md b/docs/podman-rmi.1.md index 9c080c9f1..8c22bba2c 100644 --- a/docs/podman-rmi.1.md +++ b/docs/podman-rmi.1.md @@ -1,9 +1,11 @@ -% podman-rmi(1) +% podman-image-rm(1) ## NAME -podman\-rmi - Removes one or more images +podman\-image\-rm (podman\-rmi) - Removes one or more images ## SYNOPSIS +**podman image rm** *image* ... + **podman rmi** *image* ... ## DESCRIPTION @@ -38,6 +40,10 @@ Remove all images and containers. ``` podman rmi -a -f ``` +## Exit Status +**_0_** if all specified images removed +**_1_** if one of the specified images did not exist, and no other failures +**_125_** if command fails for a reason other then an image did not exist ## SEE ALSO podman(1) diff --git a/docs/podman-run.1.md b/docs/podman-run.1.md index 828ae96a8..bbf10a2ce 100644 --- a/docs/podman-run.1.md +++ b/docs/podman-run.1.md @@ -28,6 +28,8 @@ servers in the created `resolv.conf`). Additionally, an empty file is created in each container to indicate to programs they are running in a container. This file is located at `/run/.containerenv`. +When running from a user defined network namespace, the /etc/netns/NSNAME/resolv.conf will be used if it exists, otherwise /etc/resolv.conf will be used. + ## OPTIONS **--add-host**=[] @@ -449,6 +451,7 @@ Tune the container's pids limit. Set `-1` to have unlimited pids for the contain Run container in an existing pod. If you want podman to make the pod for you, preference the pod name with `new:`. To make a pod with more granular options, use the `podman pod create` command before creating a container. +If a container is run with a pod, and the pod has an infra-container, the infra-container will be started before the container is. **--privileged**=*true*|*false* @@ -663,7 +666,7 @@ Without this argument the command will be run as root in the container. **--userns**=host **--userns**=ns:my_namespace -Set the user namespace for the container. +Set the user namespace mode for the container. The use of userns is disabled by default. - `host`: run in the user namespace of the caller. This is the default if no user namespace options are set. The processes running in the container will have the same privileges on the host as any other process launched by the calling user. - `ns`: run the container in the given existing user namespace. @@ -675,7 +678,7 @@ This option is incompatible with --gidmap, --uidmap, --subuid and --subgid Set the UTS mode for the container `host`: use the host's UTS namespace inside the container. -`ns`: specify the usernamespace to use. +`ns`: specify the user namespace to use. **NOTE**: the host mode gives the container access to changing the host's hostname and is therefore considered insecure. @@ -693,21 +696,35 @@ Current supported mount TYPES are bind, and tmpfs. Common Options: - · src, source: mount source spec for bind and volume. Mandatory for bind. + · src, source: mount source spec for bind and volume. Mandatory for bind. - · dst, destination, target: mount destination spec. + · dst, destination, target: mount destination spec. - · ro, read-only: true or false (default). + · ro, read-only: true or false (default). Options specific to bind: - · bind-propagation: Z, z, shared, slave, private, rshared, rslave, or rprivate(default). See also mount(2). + · bind-propagation: Z, z, shared, slave, private, rshared, rslave, or rprivate(default). See also mount(2). Options specific to tmpfs: - · tmpfs-size: Size of the tmpfs mount in bytes. Unlimited by default in Linux. + · tmpfs-size: Size of the tmpfs mount in bytes. Unlimited by default in Linux. + + · tmpfs-mode: File mode of the tmpfs in octal. (e.g. 700 or 0700.) Defaults to 1777 in Linux. + +**--userns**="" + +Set the user namespace mode for the container. The use of userns is disabled by default. - · tmpfs-mode: File mode of the tmpfs in octal. (e.g. 700 or 0700.) Defaults to 1777 in Linux. + **host**: use the host user namespace and enable all privileged options (e.g., `pid=host` or `--privileged`). + **ns**: specify the user namespace to use. + +**--uts**=*host* + +Set the UTS mode for the container + **host**: use the host's UTS namespace inside the container. + **ns**: specify the user namespace to use. + Note: the host mode gives the container access to changing the host's hostname and is therefore considered insecure. **--volume**, **-v**[=*[HOST-DIR:CONTAINER-DIR[:OPTIONS]]*] @@ -1074,8 +1091,8 @@ supported sysctls. ### Set UID/GID mapping in a new user namespace -If you want to run the container in a new user namespace and define the mapping of -the uid and gid from the host. +Running a container in a new user namespace requires a mapping of +the uids and gids from the host. ``` $ podman run --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello @@ -1096,13 +1113,27 @@ KillMode=process WantedBy=multi-user.target ``` +### Rootless Containers + +Podman runs as a non root user on most systems. This feature requires that a new enough version of shadow-utils +be installed. The shadow-utils package must include the newuidmap and newgidmap executables. + +Note: RHEL7 and Centos 7 will not have this feature until RHEL7.7 is released. + +In order for users to run rootless, there must be an entry for their username in /etc/subuid and /etc/subgid which lists the UIDs for their user namespace. + +Rootless podman works better if the fuse-overlayfs and slirp4netns packages are installed. +The fuse-overlay package provides a userspace overlay storage driver, otherwise users need to use +the vfs storage driver, which is diskspace expensive and does not perform well. slirp4netns is +required for VPN, without it containers need to be run with the --net=host flag. + ## FILES **/etc/subuid** **/etc/subgid** ## SEE ALSO -subgid(5), subuid(5), libpod.conf(5), systemd.unit(5), setsebool(8) +subgid(5), subuid(5), libpod.conf(5), systemd.unit(5), setsebool(8), slirp4netns(1), fuse-overlayfs(1) ## HISTORY September 2018, updated by Kunal Kushwaha <kushwaha_kunal_v7@lab.ntt.co.jp> diff --git a/docs/podman-start.1.md b/docs/podman-start.1.md index f16a20efa..b0167003e 100644 --- a/docs/podman-start.1.md +++ b/docs/podman-start.1.md @@ -8,7 +8,7 @@ podman\-start - Start one or more containers ## DESCRIPTION Start one or more containers. You may use container IDs or names as input. The *attach* and *interactive* -options cannot be used to override the *--tty** and *--interactive* options from when the container +options cannot be used to override the *--tty* and *--interactive* options from when the container was created. If you attempt to start a running container with the *--attach* option, podman will simply attach to the container. @@ -33,6 +33,8 @@ Attach container's STDIN. The default is false. Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--sig-proxy**=*true*|*false* Proxy received signals to the process (non-TTY mode only). SIGCHLD, SIGSTOP, and SIGKILL are not proxied. The default is *true* when attaching, *false* otherwise. @@ -41,9 +43,9 @@ Proxy received signals to the process (non-TTY mode only). SIGCHLD, SIGSTOP, and podman start mywebserver -podman start 860a4b23 5421ab4 +podman start 860a4b231279 5421ab43b45 -podman start -i -a 860a4b23 +podman start --interactive --attach 860a4b231279 podman start -i -l diff --git a/docs/podman-stats.1.md b/docs/podman-stats.1.md index 8fc765326..97a9be961 100644 --- a/docs/podman-stats.1.md +++ b/docs/podman-stats.1.md @@ -20,6 +20,8 @@ Show all containers. Only running containers are shown by default Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--no-reset** Do not clear the terminal/screen in between reporting intervals @@ -36,16 +38,17 @@ Valid placeholders for the Go template are listed below: | **Placeholder** | **Description** | | --------------- | --------------- | -| .ID | Container ID | +| .Pod | Pod ID | +| .CID | Container ID | | .Name | Container Name | -| .CPUPerc | CPU percentage | +| .CPU | CPU percentage | | .MemUsage | Memory usage | -| .MemPerc | Memory percentage | +| .Mem | Memory percentage | | .NetIO | Network IO | | .BlockIO | Block IO | | .PIDS | Number of PIDs | - +When using a GO template, you may preceed the format with `table` to print headers. ## EXAMPLE ``` diff --git a/docs/podman-stop.1.md b/docs/podman-stop.1.md index 813f0ef9e..2016a7301 100644 --- a/docs/podman-stop.1.md +++ b/docs/podman-stop.1.md @@ -24,6 +24,8 @@ Stop all running containers. This does not include paused containers. Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + **--timeout, --time, t** Timeout to wait before forcibly stopping the container @@ -32,11 +34,11 @@ Timeout to wait before forcibly stopping the container podman stop mywebserver -podman stop 860a4b23 +podman stop 860a4b235279 -podman stop mywebserver 860a4b23 +podman stop mywebserver 860a4b235279 -podman stop --timeout 2 860a4b23 +podman stop --timeout 2 860a4b235279 podman stop -a diff --git a/docs/podman-system-renumber.1.md b/docs/podman-system-renumber.1.md new file mode 100644 index 000000000..a88640d63 --- /dev/null +++ b/docs/podman-system-renumber.1.md @@ -0,0 +1,29 @@ +% podman-system-renumber(1) podman + +## NAME +podman\-system\-renumber - Renumber container locks + +## SYNOPSIS +** podman system renumber** + +## DESCRIPTION +** podman system renumber** renumbers locks used by containers and pods. + +Each Podman container and pod is allocated a lock at creation time, up to a maximum number controlled by the **num_locks** parameter in **libpod.conf**. + +When all available locks are exhausted, no further containers and pods can be created until some existing containers and pods are removed. This can be avoided by increasing the number of locks available via modifying **libpod.conf** and subsequently running **podman system renumber** to prepare the new locks (and reallocate lock numbers to fit the new struct). + +**podman system renumber** must be called after any changes to **num_locks** - failure to do so will result in errors starting Podman as the number of locks available conflicts with the configured number of locks. + +**podman system renumber** can also be used to migrate 1.0 and earlier versions of Podman, which used a different locking scheme, to the new locking model. It is not strictly required to do this, but it is highly recommended to do so as deadlocks can occur otherwise. + +If possible, avoid calling **podman system renumber** while there are other Podman processes running. + +## SYNOPSIS +**podman system renumber** + +## SEE ALSO +`podman(1)`, `libpod.conf(5)` + +# HISTORY +February 2019, Originally compiled by Matt Heon (mheon at redhat dot com) diff --git a/docs/podman-top.1.md b/docs/podman-top.1.md index 7782a3f29..52d1238ef 100644 --- a/docs/podman-top.1.md +++ b/docs/podman-top.1.md @@ -20,6 +20,8 @@ Display the running process of the container. The *format-descriptors* are ps (1 Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + ## FORMAT DESCRIPTORS The following descriptors are supported in addition to the AIX format descriptors mentioned in ps (1): diff --git a/docs/podman-umount.1.md b/docs/podman-umount.1.md index cceb63019..795f0402d 100644 --- a/docs/podman-umount.1.md +++ b/docs/podman-umount.1.md @@ -35,6 +35,8 @@ Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + ## EXAMPLE podman umount containerID diff --git a/docs/podman-wait.1.md b/docs/podman-wait.1.md index dd5dc7907..672316eef 100644 --- a/docs/podman-wait.1.md +++ b/docs/podman-wait.1.md @@ -22,9 +22,11 @@ After the container stops, the container's return code is printed. **--latest, -l** - Instead of providing the container name or ID, use the last created container. If you use methods other than Podman +Instead of providing the container name or ID, use the last created container. If you use methods other than Podman to run containers such as CRI-O, the last started container could be from either of those methods. +The latest option is not supported on the remote client. + ## EXAMPLES ``` diff --git a/docs/podman.1.md b/docs/podman.1.md index 51ef00383..760f27310 100644 --- a/docs/podman.1.md +++ b/docs/podman.1.md @@ -168,6 +168,7 @@ the exit codes follow the `chroot` standard, see below: | [podman-umount(1)](podman-umount.1.md) | Unmount a working container's root filesystem. | | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | | [podman-version(1)](podman-version.1.md) | Display the Podman version information. | +| [podman-volume(1)](podman-volume.1.md) | Manage Volumes. | | [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | ## FILES |