diff options
Diffstat (limited to 'docs')
| -rwxr-xr-x | docs/remote-docs.sh | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-build.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-create.1.md | 111 | ||||
| -rw-r--r-- | docs/source/markdown/podman-machine-list.1.md | 4 | ||||
| -rw-r--r-- | docs/source/markdown/podman-network-ls.1.md | 4 | ||||
| -rw-r--r-- | docs/source/markdown/podman-pod-create.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-pod-ps.1.md | 4 | ||||
| -rw-r--r-- | docs/source/markdown/podman-ps.1.md | 4 | ||||
| -rw-r--r-- | docs/source/markdown/podman-run.1.md | 121 | ||||
| -rw-r--r-- | docs/source/markdown/podman-save.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-secret-create.1.md | 2 | ||||
| -rw-r--r-- | docs/source/markdown/podman-secret-ls.1.md | 4 | ||||
| -rw-r--r-- | docs/source/markdown/podman-volume-ls.1.md | 4 |
13 files changed, 223 insertions, 43 deletions
diff --git a/docs/remote-docs.sh b/docs/remote-docs.sh index 2b7d73cd3..939c7264c 100755 --- a/docs/remote-docs.sh +++ b/docs/remote-docs.sh @@ -6,7 +6,7 @@ PLATFORM=$1 ## linux, windows or darwin TARGET=${2} ## where to output files SOURCES=${@:3} ## directories to find markdown files -# Overriden for testing. Native podman-remote binary expected filepaths +# Overridden for testing. Native podman-remote binary expected filepaths if [[ -z "$PODMAN" ]]; then case $(env -i HOME=$HOME PATH=$PATH go env GOOS) in windows) diff --git a/docs/source/markdown/podman-build.1.md b/docs/source/markdown/podman-build.1.md index 876bfe412..791e2d907 100644 --- a/docs/source/markdown/podman-build.1.md +++ b/docs/source/markdown/podman-build.1.md @@ -688,7 +688,7 @@ Set the architecture variant of the image to be pulled. bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the Podman container. (This option is not available with the remote Podman client) - The `OPTIONS` are a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup> + The `OPTIONS` are a comma-separated list and can be: <sup>[[1]](#Footnote1)</sup> * [rw|ro] * [z|Z|O] diff --git a/docs/source/markdown/podman-create.1.md b/docs/source/markdown/podman-create.1.md index db9ff937b..229bb82f5 100644 --- a/docs/source/markdown/podman-create.1.md +++ b/docs/source/markdown/podman-create.1.md @@ -261,8 +261,8 @@ Note: if _host_device_ is a symbolic link then it will be resolved first. The container will only store the major and minor numbers of the host device. Note: if the user only has access rights via a group, accessing the device -from inside a rootless container will fail. The **crun**(1) runtime offers a -workaround for this by adding the option **\-\-annotation run.oci.keep_original_groups=1**. +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. Podman may load kernel modules required for using the specified device. The devices that podman will load modules when necessary are: @@ -361,9 +361,17 @@ GID map for the user namespace. Using this flag will run the container with user The following example maps uids 0-2000 in the container to the uids 30000-31999 on the host and gids 0-2000 in the container to the gids 30000-31999 on the host. `--gidmap=0:30000:2000` -#### **\-\-group-add**=*group* +#### **\-\-group-add**=*group|keep-groups* -Add additional groups to run as +Add additional groups to assign to primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, you cannot add any other groups +with this flag. (Not available for remote commands) #### **\-\-health-cmd**=*"command"* | *'["command", "arg1", ...]'* @@ -634,7 +642,7 @@ Valid _mode_ values are: - **none**: no networking; - **container:**_id_: reuse another container's network stack; - **host**: use the Podman host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure; -- _network-id_: connect to a user-defined network, multiple networks should be comma separated; +- _network-id_: connect to a user-defined network, multiple networks should be comma-separated; - **ns:**_path_: path to a network namespace to join; - **private**: create a new namespace for the container (default) - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options: @@ -861,6 +869,8 @@ Security Options - `label=filetype:TYPE` : Set the label file type for the container files - `label=disable` : Turn off label separation for the container +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + - `mask=/path/1:/path/2` : The paths to mask separated by a colon. A masked path cannot be accessed inside the container. @@ -869,13 +879,13 @@ Security Options - `seccomp=unconfined` : Turn off seccomp confinement for the container - `seccomp=profile.json` : White listed syscalls seccomp Json file to be used as a seccomp filter +- `proc-opts=OPTIONS` : Comma-separated list of options to use for the /proc mount. More details for the + possible mount options are specified in the **proc(5)** man page. + - `unmask=ALL or /path/1:/path/2` : Paths to unmask separated by a colon. If set to **ALL**, it will unmask all the paths that are masked or made read only by default. The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.** The default paths that are read only are **/proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup**. -- `proc-opts=OPTIONS` : Comma separated list of options to use for the /proc mount. More details for the - possible mount options are specified at **proc(5)** man page. - Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. #### **\-\-shm-size**=*size* @@ -975,11 +985,72 @@ Remote connections use local containers.conf for defaults Set the umask inside the container. Defaults to `0022`. Remote connections use local containers.conf for defaults -#### **\-\-uidmap**=*container_uid:host_uid:amount* +#### **\-\-uidmap**=*container_uid*:*from_uid*:*amount* + +Run the container in a new user namespace using the supplied mapping. This +option conflicts with the **\-\-userns** and **\-\-subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The _from_uid_ value is based upon the user running the command, either rootful or rootless users. +* rootful user: *container_uid*:*host_uid*:*amount* +* rootless user: *container_uid*:*intermediate_uid*:*amount* + +When **podman create** is called by a privileged user, the option **\-\-uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that will be mapped. +If for example _amount_ is **4** the mapping would look like: + +| host UID | container UID | +| - | - | +| _from_uid_ | _container_uid_ | +| _from_uid_ + 1 | _container_uid_ + 1 | +| _from_uid_ + 2 | _container_uid_ + 2 | +| _from_uid_ + 3 | _container_uid_ + 3 | + +When **podman create** is called by an unprivileged user (i.e. running rootless), +the value _from_uid_ is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: -UID map for the user namespace. Using this flag will run the container with user namespace enabled. It conflicts with the `--userns` and `--subuidname` flags. +host UID -> intermediate UID -> container UID -The following example maps uids 0-2000 in the container to the uids 30000-31999 on the host and gids 0-2000 in the container to the gids 30000-31999 on the host. `--uidmap=0:30000:2000` +The **\-\-uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| - | - | +| UID for the user starting Podman | 0 | +| 1st subordinate UID for the user starting Podman | 1 | +| 2nd subordinate UID for the user starting Podman | 2 | +| 3rd subordinate UID for the user starting Podman | 3 | +| nth subordinate UID for the user starting Podman | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **\-\-uidmap**. + +If for example _amount_ is **5** the second mapping step would look like: + +| intermediate UID | container UID | +| - | - | +| _from_uid_ | _container_uid_ | +| _from_uid_ + 1 | _container_uid_ + 1 | +| _from_uid_ + 2 | _container_uid_ + 2 | +| _from_uid_ + 3 | _container_uid_ + 3 | +| _from_uid_ + 4 | _container_uid_ + 4 | + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**\-\-uidmap** could still be used to map the normal UID of the user to a +container UID by running `podman create --uidmap $container_uid:0:1 --user $container_uid ...`. #### **\-\-ulimit**=*option* @@ -1032,9 +1103,9 @@ Create a bind mount. If you specify, ` -v /HOST-DIR:/CONTAINER-DIR`, Podman bind mounts `/HOST-DIR` in the host to `/CONTAINER-DIR` in the Podman container. Similarly, `-v SOURCE-VOLUME:/CONTAINER-DIR` will mount the volume in the host to the container. If no such named volume exists, Podman will -create one. The `OPTIONS` are a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup> (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.) +create one. The `OPTIONS` are a comma-separated list and can be: <sup>[[1]](#Footnote1)</sup> (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.) -The _options_ is a comma delimited list and can be: +The _options_ is a comma-separated list and can be: * **rw**|**ro** * **z**|**Z** @@ -1124,7 +1195,7 @@ host into the container to allow speeding up builds. Content mounted into the container is labeled with the private label. On SELinux systems, labels in the source directory must be readable by the container label. Usually containers can read/execute `container_share_t` -and can read/write `container_file_t`. If you can not change the labels on a +and can read/write `container_file_t`. If you cannot change the labels on a source volume, SELinux container separation must be disabled for the container to work. - The source directory mounted into the container with an overlay mount @@ -1184,10 +1255,14 @@ will convert /foo into a `shared` mount point. Alternatively one can directly change propagation properties of source mount. Say `/` is source mount for `/foo`, then use `mount --make-shared /` to convert `/` into a `shared` mount. +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + #### **\-\-volumes-from**[=*CONTAINER*[:*OPTIONS*]] Mount volumes from the specified container(s). Used to share volumes between -containers. The *options* is a comma delimited list with the following available elements: +containers. The *options* is a comma-separated list with the following available elements: * **rw**|**ro** * **z** @@ -1292,6 +1367,12 @@ $ podman create --name container3 --requires container1,container2 -t -i fedora $ podman start --attach container3 ``` +### Configure keep supplemental groups for access to volume + +``` +$ podman create -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + ### Rootless Containers Podman runs as a non root user on most systems. This feature requires that a new enough version of shadow-utils diff --git a/docs/source/markdown/podman-machine-list.1.md b/docs/source/markdown/podman-machine-list.1.md index bd5608258..922c19fdf 100644 --- a/docs/source/markdown/podman-machine-list.1.md +++ b/docs/source/markdown/podman-machine-list.1.md @@ -35,6 +35,10 @@ Valid placeholders for the Go template are listed below: Print usage statement. +#### **\-\-noheading** + +Omit the table headings from the listing of pods. + ## EXAMPLES ``` diff --git a/docs/source/markdown/podman-network-ls.1.md b/docs/source/markdown/podman-network-ls.1.md index 12dbb01d3..464efdc21 100644 --- a/docs/source/markdown/podman-network-ls.1.md +++ b/docs/source/markdown/podman-network-ls.1.md @@ -41,6 +41,10 @@ Valid placeholders for the Go template are listed below: | .Labels | Network labels | | .Version | CNI Version of the config file | +#### **\-\-noheading** + +Omit the table headings from the listing of networks. + #### **\-\-no-trunc** Do not truncate the network ID. The network ID is not displayed by default and must be specified with **\-\-format**. diff --git a/docs/source/markdown/podman-pod-create.1.md b/docs/source/markdown/podman-pod-create.1.md index 9ecde1ca3..6f3d7f1ca 100644 --- a/docs/source/markdown/podman-pod-create.1.md +++ b/docs/source/markdown/podman-pod-create.1.md @@ -125,7 +125,7 @@ If another pod with the same name already exists, replace and remove it. The de #### **\-\-share**=*namespace* -A comma delimited list of kernel namespaces to share. If none or "" is specified, no namespaces will be shared. The namespaces to choose from are ipc, net, pid, uts. +A comma-separated list of kernel namespaces to share. If none or "" is specified, no namespaces will be shared. The namespaces to choose from are ipc, net, pid, uts. The operator can identify a pod in three ways: UUID long identifier (“f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778”) diff --git a/docs/source/markdown/podman-pod-ps.1.md b/docs/source/markdown/podman-pod-ps.1.md index 0be22c2b1..d4fd6d41c 100644 --- a/docs/source/markdown/podman-pod-ps.1.md +++ b/docs/source/markdown/podman-pod-ps.1.md @@ -42,6 +42,10 @@ Includes the container statuses in the container info field Show the latest pod created (all states) (This option is not available with the remote Podman client) +#### **\-\-noheading** + +Omit the table headings from the listing of pods. + #### **\-\-no-trunc** Display the extended information diff --git a/docs/source/markdown/podman-ps.1.md b/docs/source/markdown/podman-ps.1.md index b950fede4..b9d12adc6 100644 --- a/docs/source/markdown/podman-ps.1.md +++ b/docs/source/markdown/podman-ps.1.md @@ -100,6 +100,10 @@ Show the latest container created (all states) (This option is not available wit Display namespace information +#### **\-\-noheading** + +Omit the table headings from the listing of containers. + #### **\-\-no-trunc** Display the extended information diff --git a/docs/source/markdown/podman-run.1.md b/docs/source/markdown/podman-run.1.md index f84a5913c..2e6d97a05 100644 --- a/docs/source/markdown/podman-run.1.md +++ b/docs/source/markdown/podman-run.1.md @@ -299,8 +299,8 @@ Note: if _host_device_ is a symbolic link then it will be resolved first. The container will only store the major and minor numbers of the host device. Note: if the user only has access rights via a group, accessing the device -from inside a rootless container will fail. The **crun**(1) runtime offers a -workaround for this by adding the option **\-\-annotation run.oci.keep_original_groups=1**. +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. Podman may load kernel modules required for using the specified device. The devices that Podman will load modules when necessary are: @@ -405,9 +405,17 @@ Meaning **groupname** is initially mapped to gid **100000** which is referenced above: The group **groupname** is mapped to group **100000** of the initial namespace then the **30000**st id of this namespace (which is gid 130000 in this namespace) is mapped to container namespace group id **0**. (groupname -> 100000 / 30000 -> 0) -#### **\-\-group-add**=*group* +#### **\-\-group-add**=*group|keep-groups* -Add additional groups to run as +Add additional groups to assign to primary user running within the container process. + +- `keep-groups` is a special flag that tells Podman to keep the supplementary group access. + +Allows container to use the user's supplementary group access. If file systems or +devices are only accessible by the rootless user's group, this flag tells the OCI +runtime to pass the group access into the container. Currently only available +with the `crun` OCI runtime. Note: `keep-groups` is exclusive, you cannot add any other groups +with this flag. (Not available for remote commands) #### **\-\-health-cmd**=*"command"* | *'["command", "arg1", ...]'* @@ -670,7 +678,7 @@ Valid _mode_ values are: - **none**: no networking; - **container:**_id_: reuse another container's network stack; - **host**: use the Podman host network stack. Note: the host mode gives the container full access to local system services such as D-bus and is therefore considered insecure; -- _network-id_: connect to a user-defined network, multiple networks should be comma separated; +- _network-id_: connect to a user-defined network, multiple networks should be comma-separated; - **ns:**_path_: path to a network namespace to join; - **private**: create a new namespace for the container (default) - **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options: @@ -905,19 +913,27 @@ Security Options - **apparmor=unconfined** : Turn off apparmor confinement for the container - **apparmor**=_your-profile_ : Set the apparmor confinement profile for the container + - **label=user:**_USER_: Set the label user for the container processes - **label=role:**_ROLE_: Set the label role for the container processes - **label=type:**_TYPE_: Set the label process type for the container processes - **label=level:**_LEVEL_: Set the label level for the container processes - **label=filetype:**TYPE_: Set the label file type for the container files - **label=disable**: Turn off label separation for the container + +Note: Labeling can be disabled for all containers by setting label=false in the **containers.conf** (`/etc/containers/containers.conf` or `$HOME/.config/containers/containers.conf`) file. + - **mask**=_/path/1:/path/2_: The paths to mask separated by a colon. A masked path cannot be accessed inside the container. + - **no-new-privileges**: Disable container processes from gaining additional privileges + - **seccomp=unconfined**: Turn off seccomp confinement for the container - **seccomp**=_profile.json_: Allowed syscall list seccomp JSON file to be used as a seccomp filter -- **proc-opts**=_OPTIONS_ : Comma separated list of options to use for the /proc mount. More details - for the possible mount options are specified at **proc(5)** man page. + +- **proc-opts**=_OPTIONS_ : Comma-separated list of options to use for the /proc mount. More details + for the possible mount options are specified in the **proc(5)** man page. + - **unmask**=_ALL_ or _/path/1:/path/2_: Paths to unmask separated by a colon. If set to **ALL**, it will unmask all the paths that are masked or made read only by default. The default masked paths are **/proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.**. The default paths that are read only are **/proc/asound**, **/proc/bus**, **/proc/fs**, **/proc/irq**, **/proc/sys**, **/proc/sysrq-trigger**, **/sys/fs/cgroup**. @@ -1047,23 +1063,72 @@ Remote connections use local containers.conf for defaults Set the umask inside the container. Defaults to `0022`. Remote connections use local containers.conf for defaults -#### **\-\-uidmap**=*container_uid*:*host_uid*:*amount* +#### **\-\-uidmap**=*container_uid*:*from_uid*:*amount* + +Run the container in a new user namespace using the supplied mapping. This +option conflicts with the **\-\-userns** and **\-\-subuidname** options. This +option provides a way to map host UIDs to container UIDs. It can be passed +several times to map different ranges. + +The _from_uid_ value is based upon the user running the command, either rootful or rootless users. +* rootful user: *container_uid*:*host_uid*:*amount* +* rootless user: *container_uid*:*intermediate_uid*:*amount* + +When **podman run** is called by a privileged user, the option **\-\-uidmap** +works as a direct mapping between host UIDs and container UIDs. + +host UID -> container UID + +The _amount_ specifies the number of consecutive UIDs that will be mapped. +If for example _amount_ is **4** the mapping would look like: -Run the container in a new user namespace using the supplied mapping. This option conflicts -with the **\-\-userns** and **\-\-subuidname** flags. -This option can be passed several times to map different ranges. If calling **podman run** -as an unprivileged user, the user needs to have the right to use the mapping. See **subuid**(5). +| host UID | container UID | +| - | - | +| _from_uid_ | _container_uid_ | +| _from_uid_ + 1 | _container_uid_ + 1 | +| _from_uid_ + 2 | _container_uid_ + 2 | +| _from_uid_ + 3 | _container_uid_ + 3 | -The following example maps uids 0-1999 in the container to the uids 30000-31999 on the host: **\-\-uidmap=0:30000:2000**. +When **podman run** is called by an unprivileged user (i.e. running rootless), +the value _from_uid_ is interpreted as an "intermediate UID". In the rootless +case, host UIDs are not mapped directly to container UIDs. Instead the mapping +happens over two mapping steps: -**Important note:** The new user namespace mapping based on **\-\-uidmap** is based on the initial mapping made in the _/etc/subuid_ file. -Assuming there is a _/etc/subuid_ mapping **username:100000:65536**, then **username** is initially mapped to a namespace starting with -uid **100000** for **65536** ids. From here the **\-\-uidmap** mapping to the new namespace starts from **0** again, but is based on the initial mapping. -Meaning **username** is initially mapped to uid **100000** which is referenced as **0** in the following **\-\-uidmap** mapping. In terms of the example -above: The user **username** is mapped to user **100000** of the initial namespace then the -**30000**st id of this namespace (which is uid 130000 in this namespace) is mapped to container namespace user id **0**. (username -> 100000 / 30000 -> 0) +host UID -> intermediate UID -> container UID -_Note_: A minimal mapping has to have at least container uid **0** mapped to the parent user namespace. +The **\-\-uidmap** option only influences the second mapping step. + +The first mapping step is derived by Podman from the contents of the file +_/etc/subuid_ and the UID of the user calling Podman. + +First mapping step: + +| host UID | intermediate UID | +| - | - | +| UID for the user starting Podman | 0 | +| 1st subordinate UID for the user starting Podman | 1 | +| 2nd subordinate UID for the user starting Podman | 2 | +| 3rd subordinate UID for the user starting Podman | 3 | +| nth subordinate UID for the user starting Podman | n | + +To be able to use intermediate UIDs greater than zero, the user needs to have +subordinate UIDs configured in _/etc/subuid_. See **subuid**(5). + +The second mapping step is configured with **\-\-uidmap**. + +If for example _amount_ is **5** the second mapping step would look like: + +| intermediate UID | container UID | +| - | - | +| _from_uid_ | _container_uid_ | +| _from_uid_ + 1 | _container_uid_ + 1 | +| _from_uid_ + 2 | _container_uid_ + 2 | +| _from_uid_ + 3 | _container_uid_ + 3 | +| _from_uid_ + 4 | _container_uid_ + 4 | + +Even if a user does not have any subordinate UIDs in _/etc/subuid_, +**\-\-uidmap** could still be used to map the normal UID of the user to a +container UID by running `podman run --uidmap $container_uid:0:1 --user $container_uid ...`. #### **\-\-ulimit**=*option* @@ -1115,7 +1180,7 @@ container. Similarly, _SOURCE-VOLUME_:_/CONTAINER-DIR_ will mount the volume in the host to the container. If no such named volume exists, Podman will create one. (Note when using the remote client, the volumes will be mounted from the remote server, not necessarly the client machine.) -The _options_ is a comma delimited list and can be: <sup>[[1]](#Footnote1)</sup> +The _options_ is a comma-separated list and can be: <sup>[[1]](#Footnote1)</sup> * **rw**|**ro** * **z**|**Z** @@ -1203,7 +1268,7 @@ host into the container to allow speeding up builds. Content mounted into the container is labeled with the private label. On SELinux systems, labels in the source directory must be readable by the container label. Usually containers can read/execute `container_share_t` -and can read/write `container_file_t`. If you can not change the labels on a +and can read/write `container_file_t`. If you cannot change the labels on a source volume, SELinux container separation must be disabled for the container to work. - The source directory mounted into the container with an overlay mount @@ -1265,10 +1330,14 @@ will convert /foo into a shared mount point. Alternatively, one can directly change propagation properties of source mount. Say, if _/_ is source mount for _/foo_, then use **mount --make-shared /** to convert _/_ into a shared mount. +Note: if the user only has access rights via a group, accessing the volume +from inside a rootless container will fail. Use the `--group-add keep-groups` +flag to pass the user's supplementary group access into the container. + #### **\-\-volumes-from**[=*CONTAINER*[:*OPTIONS*]] Mount volumes from the specified container(s). Used to share volumes between -containers. The *options* is a comma delimited list with the following available elements: +containers. The *options* is a comma-separated list with the following available elements: * **rw**|**ro** * **z** @@ -1652,6 +1721,12 @@ $ podman create --name container2 -t -i fedora bash $ podman run --name container3 --requires container1,container2 -t -i fedora bash ``` +### Configure keep supplemental groups for access to volume + +``` +$ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 +``` + ### Rootless Containers Podman runs as a non root user on most systems. This feature requires that a new enough version of **shadow-utils** diff --git a/docs/source/markdown/podman-save.1.md b/docs/source/markdown/podman-save.1.md index e6f6e993b..0036a9379 100644 --- a/docs/source/markdown/podman-save.1.md +++ b/docs/source/markdown/podman-save.1.md @@ -27,7 +27,7 @@ Note: `:` is a restricted character and cannot be part of the file name. #### **\-\-compress** Compress tarball image layers when pushing to a directory using the 'dir' transport. (default is same compression type, compressed or uncompressed, as source) -Note: This flag can only be set when using the **dir** transport i.e --format=oci-dir or --format-docker-dir +Note: This flag can only be set when using the **dir** transport i.e --format=oci-dir or --format=docker-dir #### **\-\-output**, **-o**=*file* diff --git a/docs/source/markdown/podman-secret-create.1.md b/docs/source/markdown/podman-secret-create.1.md index ca92dd38e..f5a97a0f3 100644 --- a/docs/source/markdown/podman-secret-create.1.md +++ b/docs/source/markdown/podman-secret-create.1.md @@ -16,7 +16,7 @@ A secret is a blob of sensitive data which a container needs at runtime but should not be stored in the image or in source control, such as usernames and passwords, TLS certificates and keys, SSH keys or other important generic strings or binary content (up to 500 kb in size). -Secrets will not be commited to an image with `podman commit`, and will not be in the archive created by a `podman export` +Secrets will not be committed to an image with `podman commit`, and will not be in the archive created by a `podman export` ## OPTIONS diff --git a/docs/source/markdown/podman-secret-ls.1.md b/docs/source/markdown/podman-secret-ls.1.md index 57a606738..18119542e 100644 --- a/docs/source/markdown/podman-secret-ls.1.md +++ b/docs/source/markdown/podman-secret-ls.1.md @@ -16,6 +16,10 @@ Lists all the secrets that exist. The output can be formatted to a Go template u Format secret output using Go template. +#### **\-\-noheading** + +Omit the table headings from the listing of secrets. . + ## EXAMPLES ``` diff --git a/docs/source/markdown/podman-volume-ls.1.md b/docs/source/markdown/podman-volume-ls.1.md index 5214980a3..47e44efc1 100644 --- a/docs/source/markdown/podman-volume-ls.1.md +++ b/docs/source/markdown/podman-volume-ls.1.md @@ -26,6 +26,10 @@ Format volume output using Go template. Print usage statement. +#### **\-\-noheading** + +Omit the table headings from the listing of volumes. + #### **\-\-quiet**, **-q** Print volume output in quiet mode. Only print the volume names. |