containers.conf(5) File Formats Manual containers.conf(5) (NAME) containers.conf - . (DESCRIPTION) Podman Buildah containers.conf . containers.conf TOML . $XDG_CONFIG_HOME/containers/containers.conf ( $XDG_CONFIG_HOME $HOME/.config/containers/containers.conf) /etc/containers/containers.conf /usr/share/containers/containers.conf. containers.conf (drop-in) : - $XDG_CONFIG_HOME/containers/containers.conf.d ( $XDG_CONFIG_HOME $HOME/.config/containers/containers.conf.d) - /etc/containers/containers.rootful.conf.d ( uid 0) - /etc/containers/containers.rootless.conf.d/$UID ( uid > 0) - /etc/containers/containers.rootless.conf.d ( uid > 0) - /etc/containers/containers.conf.d - /usr/share/containers/containers.rootful.conf.d ( uid 0) - /usr/share/containers/containers.rootless.conf.d/$UID ( uid > 0) - /usr/share/containers/containers.rootless.conf.d ( uid > 0) - /usr/share/containers/containers.conf.d .conf . - . . . containers.conf containers.conf (override) . containers-config(5) . . : o storage.conf . o registries.conf (pull) . o policy.conf . : Podman podman machine ( Mac Windows) podman machine ssh . (ENVIRONMENT VARIABLES) CONTAINERS_CONF . CONTAINERS_CONF_OVERRIDE CONTAINERS_CONF . : CONTAINERS_CONF=/tmp/my_containers.conf. (MODULES) containers.conf : - \$XDG_CONFIG_HOME/containers/containers.conf.modules \$HOME/.config/containers/containers.conf.modules $XDG_CONFIG_HOME - /etc/containers/containers.conf.modules - /usr/share/containers/containers.conf.modules . CONTAINERS_CONF_OVERRIDE . podman(1) . podman --module . . $XDG_CONFIG_HOME/$HOME /etc /usr/share . (APPENDING TO STRING ARRAYS) containers.conf . () append : array=["item-1", "item=2", ..., {append=true}]. append . {append=false} . : modules1.conf: env=["1=true"] modules2.conf: env=["2=true"] modules3.conf: env=["3=true", {append=true}] modules4.conf: env=["4=true"] env=["2=true", "3=true", "4=true"] . modules4.conf {append=false} env=["4=true"] . (FORMAT) TOML . . TOML : [table1] option = value [table2] option = value [table3] option = value [table3.subtable1] option = value CONTAINERS (CONTAINERS TABLE) containers OCI (OCI runtime) . annotations = [] (annotations). "key=value" . : "run.oci.keep_original_groups=1" apparmor_profile="container-default" AppArmor . "container-default" . base_hosts_file="" /etc/hosts . : "" /etc/hosts () none ( ) image /etc/hosts cgroup_conf=[] cgroup_conf cgroup . memory.high=1073741824 memory.high 1GB . cgroups="enabled" CGroup . : enabled cgroup disabled cgroup cgroup no-conmon cgroup conmon. cgroupns="private" cgroup . : private Cgroup . host Cgroup . container_name_as_hostname=true|false (hostname) ( hostname) hostname . UTS hostname hostname . false . default_capabilities=[] (capabilities) . : default_capabilities = [ "CHOWN", "DAC_OVERRIDE", "FOWNER", "FSETID", "KILL", "NET_BIND_SERVICE", "SETFCAP", "SETGID", "SETPCAP", "SETUID", "SYS_CHROOT", ] containers.conf Docker . "AUDIT_WRITE" "MKNOD" "NET_RAW" . --cap- add containers.conf . default_sysctls=[] sysctl "name=value". : "net.ipv4.ping_group_range=0 1000". default_ulimits=[] ulimit "name=soft-limit:hard- limit". : "nofile=1024:2048". devices=[] . 'device-on-host:device-on-container:permissions'. : "/dev/sdc:/dev/xvdc:rwm". dns_options=[] DNS /etc/resolv.conf . dns_searches=[] DNS /etc/resolv.conf . dns_servers=[] dns DNS . <> /etc/resolv.conf . env=["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"] . . podman exec. . env_host=false . host_containers_internal_ip="" IP . IP Podman host.containers.internal host.docker.internal /etc/hosts . host- gateway --add-host Podman . IP () Podman . /etc/hosts . none /etc/hosts . : Podman podman machine ( Mac Windows) Podman host.containers.internal DNS (gvproxy) . DNS gvproxy none . gvproxy . : IP Podman . IP IP . http_proxy=true . : http_proxy, https_proxy, ftp_proxy, no_proxy . no_proxy . . init=false init (zombie/reaped) . init_path="/usr/libexec/podman/catatonit" catatonit helper_binaries_dir . catatonit . container-init . container-init --init podman-create podman-run . interface_name="" . ethX ( X ) . : device network_interface . network_interface ethX . ipcns="shareable" IPC . : host IPC . none IPC /dev/shm . private IPC . shareable IPC . keyring=true keyring . label=true MAC(SELinux) . . label_users=false label_users SELinux . . SELinux system_u system_r . log_driver="" . k8s-file, journald, none passthrough json-file k8s-file . journal journald k8s-file . log_path="" . . ctr.log . --log-opt . log_size_max=-1 . . >= 8192 conmon . (truncate) . log_tag="" . . . mounts=[] mount. "type=TYPE,source=,destination=," : [ "type=bind,source=/var/lib/foobar,destination=/var/lib/foobar,ro", ] netns="" NET . --network podman . bridge, host, none, pasta podman-create(1) . no_hosts=false /etc/hosts . Podman /etc/hosts --add-host . true --no-hosts . oom_score_adj=0 OOM ( -1000 1000 ). pidns="private" PID . : private PID . host PID . pids_limit=1024 . 0 . prepare_volume_on_create=false (volume) . false . true . privileged=false . (privileged) . Apparmor/SELinux Seccomp . privileged . ( / rootless) . read_only=true|false . false . seccomp_profile="/usr/share/containers/seccomp.json" seccomp.json seccomp . shm_size="65536k" /dev/shm. . number 0 . : b () k () m () g (). . 65536k . tz="" . IANA local . . : tz="local" tz="America/New_York" umask="0022" umask . userns="host" USER . : private USER UID. host USER . UID . auto USER . keep-id private UID UID (subordinate) /etc/subuid UID:GID . no-map keep-id UID:GID UID:GID . utsns="private" UTS . : private UTS . host UTS . volumes=[] (volumes). "directory-on-host:directory-in-container:options". : "/db:/var/lib/db:ro". NETWORK (NETWORK TABLE) network . network_backend="" . "netavark" . "netavark" . netavark_plugin_dirs=[] netavark . : netavark_plugin_dirs = [ "/usr/local/libexec/netavark", "/usr/libexec/netavark", "/usr/local/lib/netavark", "/usr/lib/netavark", ] default_network="podman" podman network ls . bridge ( --network bridge) . (rootful) (rootless) . netns [containers] . : . default_subnet="10.88.0.0/16" ( default_network). : . default_subnet_pools=[] DefaultSubnetPools podman network create . . ipv4 ipv6 . (10.89.0.0-10.255.255.0/24) : default_subnet_pools = [ {"base" = "10.89.0.0/16", "size" = 24}, {"base" = "10.90.0.0/15", "size" = 24}, {"base" = "10.92.0.0/14", "size" = 24}, {"base" = "10.96.0.0/11", "size" = 24}, {"base" = "10.128.0.0/9", "size" = 24}, ] default_rootless_network_cmd="pasta" . pasta (). rootless_port_forwarder="rootlessport" bridge . rootlessport () pasta. rootlessport TCP/UDP . pasta pasta kernel splice IP . pasta (experimental) . : . netns . network_config_dir="/etc/containers/networks" . "/etc/containers/networks" "$graphroot/networks" . firewall_driver="" netavark. netavark . "nftables" "none" ( ) "firewalld" ( firewalld ). dns_bind_port=53 dns netavark bridge dns. dns . pasta_options = [] pasta pasta . pasta pasta(1) . default_host_ips=[] IP (bind) IP -p ( -p 8000:8000). (0.0.0.0 IPv4 :: IPv6). IP IP . ["127.0.0.1", "::1"] -p 8080:80 podman : 127.0.0.1:8080:80 [::1]:8080:80. IP -p ( -p 192.168.1.10:8000:8000) . ENGINE (ENGINE TABLE) engine Podman Buildah . active_service="" Podman. SERVICE DESTINATION TABLE . add_compression=[] . manifest push . (gzip, zstd zstd:chunked). zstd:chunked zstd . : compression_format push manifest push add_compression manifest push add_compression . cgroup_manager="systemd" cgroup . cgroupfs systemd . compat_api_enforce_docker_hub=true docker.io REST API Podman. unqualified-search-registries short-name containers-registries.conf(5) . compose_providers=[] compose. . . compose_warning_logs=true compose compose . conmon_env_vars=[] Conmon. conmon_path=[] conmon. $PATH . : conmon_path=[ "/usr/libexec/podman/conmon", "/usr/local/libexec/podman/conmon", "/usr/local/lib/podman/conmon", "/usr/bin/conmon", "/usr/sbin/conmon", "/usr/local/bin/conmon", "/usr/local/sbin/conmon", "/run/current-system/sw/bin/conmon", ] detach_keys="ctrl-p,ctrl-q" (detach) . . [a-Z] ctrl- : a- z, @, ^, [, \, ], ^ _ "" . enable_port_reservation=true . conmon . . . . pasta(1) bind . env=[] ( Podman Buildah) "MYVAR=value". . env [containers] . http http_proxy ( [containers]) true () false . events_logfile_path="" events_logger "file" . events_logfile_max_size="1m" events_logfile_path . b () k () m () g () . 1b 3g. . (rotate) . 0 . events_logger="journald" . Podman . : podman info --format {{.Host.EventLogger}} : file, journald, none. events_container_create_inspect_data=true|false container-create JSON . false . force_port_listen=false Podman listen() TCP . ( "::1") accept() . (listening) . true Podman listen() . enable_port_reservation . healthcheck_events=true|false Podman (healthcheck) . healthcheck . healthcheck false . true . helper_binaries_dir=["/usr/libexec/podman", ...] . : - aardvark-dns - catatonit - netavark - pasta Podman : - gvproxy - qemu - vfkit : o /usr/local/libexec/podman o /usr/local/lib/podman o /usr/libexec/podman o /usr/lib/podman macOS : o /usr/local/opt/podman/libexec o /opt/homebrew/bin o /opt/homebrew/opt/podman/libexec o /usr/local/bin o /usr/local/libexec/podman o /usr/local/lib/podman o /usr/libexec/podman o /usr/lib/podman Windows : o C:\Program Files\RedHat\Podman hooks_dir=["/etc/containers/oci/hooks.d", ...] OCI . cdi_spec_dirs=["/etc/cdi", "/var/run/cdi", ...] CDI Spec. image_default_format="oci"|"v2s2"|"v2s1" (oci, v2s2, v2s1) . . / (commit) OCI . : image_build_format . image_default_transport="docker://" . image_parallel_copies=0 (/) . containers/image (6). image_volume_mode="bind" . o bind: (mount) . o tmpfs: tmpfs . o ignore: . infra_command="/pause" (pause) . /pause . . infra_image="" (pause) . pause . . pause . . kube_generate_type="pod" / Kubernetes yaml podman kube generate. pod deployment. lock_type="shm" "shm" "file" . . "file" cgo "shm" . "podman system renumber" . multi_image_archive=false ( tarball) . Podman . . namespace="" . . "" . . no_pivot_root=false pivot_root chroot . num_locks=2048 . . . 2048 . podman system renumber . pod_exit_policy="continue" . : +------------+----------------------------+ |Exit Policy | Description | +------------+----------------------------+ |continue | | | | | | | | | | | | | | | | | | | . | | | | | | | | | | | | . | +------------+----------------------------+ |stop | | | | | | | | | | | | | | | | . | | | play kube | | | | | | . | +------------+----------------------------+ pull_policy="always"|"missing"|"never" . missing . o missing: registries.conf . . o always: registries.conf . . o never: . . remote = false . --remote . true podman --remote=true Podman . retry = 3 / . retry_delay = "" / . . runtime="" OCI runtimes . runtimes . : "crun", "runc", "runj", "kata", "runsc", "ocijail" runtime_supports_json=["crun", "crun-vm", "runc", "kata", "runsc", "youki", "krun"] OCI --format=json . runtime_supports_kvm=["kata", "krun"] OCI KVM . runtime_supports_nocgroups=["crun", "crun-vm", "krun"] OCI CGroups . image_copy_tmp_dir="/var/tmp" . TMPDIR . "storage" container/storage . . tmpfiles.d(5) . service_timeout=5 podman system service . static_dir="/var/lib/containers/storage/libpod" libpod ( ). containers/storage . stop_timeout=10 kill. exit_command_delay=300 API exec ( Docker ). tmp_dir="/run/libpod" (per-boot). tmpfs ( ). volume_path="/var/lib/containers/storage/volumes" . containers/storage . . chown_copied_files=true uid/gid . compression_format="gzip" . : gzip, zstd zstd:chunked. docker-daemon docker-archive . v2s2 . zstd:chunked zstd . compression_level="5" . . gzip 1-9 5 . zstd 1-20 3 . SERVICE DESTINATION (SERVICE DESTINATION TABLE) engine.service_destinations podman API . [engine.service_destinations.{name}] URI Podman uri="ssh://user@production.example.com/run/user/1001/podman/podman.sock" URI: o rootless local - unix:///run/user/1000/podman/podman.sock o rootless remote - ssh://user@engineering.lab.company.com/run/user/1000/podman/podman.sock o rootful local - unix:///run/podman/podman.sock o rootful remote - ssh://root@10.10.1.136:22/run/podman/podman.sock o tcp/tls remote - tcp://10.10.1.136:9443 identity="~/.ssh/id_rsa ssh tls_cert="/path/to/certs/podman/tls.crt" PEM TLS tls_key="/path/to/certs/podman/tls.key" PEM TLS tls_ca="/path/to/certs/podman/ca.crt" PEM (CA) TLS [engine.runtimes_flags] OCI (crun, runc, kata, runsc, krun, ). . [engine.volume_plugins] . Podman . ( ) ( ) . [engine.platform_to_oci_runtime] OCI . platform/string = oci_runtime . SECRET (SECRET TABLE) secret secret . driver=file secret . : * file * pass [secrets.opts] . MACHINE (MACHINE TABLE) machine podman machine . cpus=1 . disk_size=10 podman-machine . image="docker://quay.io/podman/machine-os" podman machine init. OCI . docker://registry/repo/image:version . $OS $ARCH URI OS ARCH . "https://example.com/$OS/$ARCH/foobar.ami" AMD "https://example.com/linux/amd64/foobar.ami" . Podman . memory=2048 . user="" podman . user . Linux/Mac core . volumes=["$HOME:$HOME"] . $HOME . :ro . : [ "/Users:/Users", "/private:/private", "/var/folders:/var/folders" ] provider="" podman-machine. . +---------+--------------------------------------------+------------------------------+ |Platform | Default Virtualization provider | Optional | +---------+--------------------------------------------+------------------------------+ |Linux | "" (qemu) | None | +---------+--------------------------------------------+------------------------------+ |Windows | "" ("wsl": Windows Subsystem for Linux) | "hyperv" (Windows Server | | | | Virtualization) | +---------+--------------------------------------------+------------------------------+ |Mac | "" ("libkrun": | "applehv" (Apple Hypervisor) | | | | | | | libkrun | | | | | | | | | | | | GPU | | | | ) | | +---------+--------------------------------------------+------------------------------+ rosetta=false Rosetta x86_64 Podman Apple Silicon . false . AppleHV(arm64) . import_native_ca=false CA . true . . false . FARMS (FARMS TABLE) farms (builds) podman buildfarm . default="" . [farms.list] . PODMANSH (PODMANSH TABLE) podmansh podmansh . shell="/bin/sh" . /bin/sh . container="podmansh" podmansh . podmansh . timeout=0 podmansh. engine.podmansh_timeout . 30 . (SEE ALSO) containers-config(5), containers-storage.conf(5), containers- policy.json(5), containers-registries.conf(5), tmpfiles.d(5) containers.conf(5)