podman-build(1) General Commands Manual podman-build(1) (NAME) podman-build - Containerfile (SYNOPSIS) podman build [] [] podman image build [] [] (DESCRIPTION) podman build Containerfile Dockerfile (build context) . Containerfile Dockerfile . Containerfile Containerfile Dockerfile . podman build . -f . URL http(s) git Containerfile . podman buildx build podman build . buildx build . buildx build . (OPTIONS) --add-host=hostname[;hostname[;...]]:ip IP ( host:ip) /etc/hosts . hostname:ip . --add-host . --no-hosts . IP host-gateway . IP . IP Podman host- gateway Podman . IP host_containers_internal_ip containers.conf . host-gateway Podman host.containers.internal host.docker.internal /etc/hosts . --no-hosts host_containers_internal_ip="none" containers.conf . host-gateway Podman IP Podman /etc/hosts . Podman podman machine ( ) Podman /etc/hosts IP DNS gvproxy . Podman /etc/hosts /etc/hosts . base_hosts_file containers.conf . --all-platforms --platform . scratch scratch . --annotation=annotation=value (annotation) ( annotation=value) . . annotation = value annotation . : Docker Docker . --arch=arch (ARCH) (pull) ( ) . (: arm arm64 386 amd64 ppc64le s390x) --authfile=path . ${XDG_RUNTIME_DIR}/containers/auth.json . containers-auth.json(5) . podman login . $HOME/.docker/config.json docker login . : REGISTRY_AUTH_FILE . export REGISTRY_AUTH_FILE=path --build-arg=arg=value Containerfiles . Containerfile (BUILD TIME VARIABLES) <#build-time-variables> . --build-arg-file=path arg=value . argfile.conf . () # . arg=value --build-arg . --build-arg-file --build-arg . --build-arg-file --build-arg . . --build-arg --build-arg- file . --build-context=name=value . COPY . : * - --build-context project2=../path/to/project2/src * HTTP tarball - --build-context src=https://example.org/releases/src.tar * - container-image:// --build-context alpine=container-image://alpine:3.15 ( docker:// docker-image:// ) Containerfile <> . : FROM [name] COPY --from=[name] ... RUN --mount=from=[name] [name] : o --build- context [name]=.. o AS [name] Containerfile o [name] --cache-from=image . Podman (pull) . Podman (cache hits) . --cache-to . # populate a cache and also consult it podman build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . : --cache-from --layers . : --cache-from Podman --cache-from Docker BuildKit . Podman Docker BuildKit . Podman kaniko . Podman . --cache-to=image . Podman (push) . : --cache-from . # populate a cache and also consult it podman build -t test --layers --cache-to registry/myrepo/cache --cache-from registry/myrepo/cache . : --cache-to --layers . : --cache-to Podman --cache-to Docker BuildKit . Podman Docker BuildKit . Podman kaniko . Podman . --cache-ttl duration . --cache-ttl=1h Podman . : --cache-ttl=0 --no-cache . --cap-add=CAP_xxx RUN (capability) . . --cap-add=CAP_xxx RUN . . --cap-drop=CAP_xxx RUN . CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER CAP_FSETID CAP_KILL CAP_NET_BIND_SERVICE CAP_SETFCAP CAP_SETGID CAP_SETPCAP CAP_SETUID . containers.conf(5) . --cap-add --cap-drop . --cert-dir=path path (*.crt *.cert *.key) HTTPS ADD . /etc/containers/certs.d . --cgroup-parent=path cgroups cgroup RUN . cgroups init . cgroup . --cgroupns=how cgroup (cgroup namespaces) RUN . "" ( ) "private" cgroup "host" cgroup podman . --compat-volumes VOLUME ( ) ADD COPY . RUN (revert) . . --compress (CLI) . Podman (context directory) . Podman . --compression-format=gzip | zstd | zstd:chunked . : gzip zstd zstd:chunked. zstd:chunked zstd . compression_format containers.conf . --cache-to ( dir: oci: oci-archive: ) . ( ) podman push . --compression-level=level . zstd - ( ) gzip - ( ) . compression_level containers.conf . --cpp-flag=flags cpp(1). Containerfile ".in" cpp(1) . cpp . : BUILDAH_CPPFLAGS CPPFLAGS ( export BUILDAH_CPPFLAGS="-DDEBUG"). --cpu-period=limit CPU (CFS) . (quota) . . (non-root) . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-cpu-limits-fails-with-a-permissions-error --cpu-quota=limit (quota) CFS ( ) . . () . (non-root) . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-cpu-limits-fails-with-a-permissions-error --cpu-shares, -c=shares ( ) . . --cpu-shares . . . . cpu-share cpu-share . . cpu-share . . . . . . . {C0} -c=512 {C1} -c=1024 : PID container CPU CPU share 100 {C0} 0 100% of CPU0 101 {C1} 1 100% of CPU1 102 {C1} 2 100% of CPU2 --cpuset-cpus=number (0-3, 0,1) --cpuset-mems=nodes (MEMs) (0-3, 0,1). NUMA . (0-3) --cpuset-mems=0,1 . --created-annotation (annotation) ( : --annotation) () "org.opencontainers.image.created" --source-date-epoch --timestamp ( ) . false . : . --creds=[username[:password]] [username[:password]] . . (echo) . --cw=options (confidential workload) (TEE) krun ( crun libkrun krun ). (rootfs) krun . options key=value . (keys) : attestation_url: / (key broker / attestation server). . krun . passphrase . cpus: (vCPU) . . firmware_library: libkrunfw-sev. podman . memory: . . passphrase: . attestation_url . attestation_url passphrase . slop: (..%) ( KB MB) . podman . type: (TEE) . "SEV" ( AMD - ) "SNP" ( AMD - ). "SNP" . workload_id: . . --decryption-key=key[:passphrase] [key[:passphrase]] . / . . . --device=host-device[:container-device][:permissions] RUN . permissions r w m mknod(2) . : --device=/dev/sdc:/dev/xvdc:rwm. : host-device (symbolic link) . (major and minor numbers) . (CDI) (https://github.com/cncf-tags/container- device-interface). : (rootless) . crun(1) --annotation run.oci.keep_original_groups=1 . --disable-compression -D . (push) . --disable- compression=false . --disable-compression, -D . . --disable-content-trust Podman . (NOOP) . --dns=ipaddr DNS . --dns --network=none . DNS . DNS ( 127.0.0.1). --dns . none /etc/resolv.conf Podman . /etc/resolv.conf . --dns-option=option DNS . --dns-option --network=none . --dns-search=domain DNS . --dns-search --network=none . --env=env[=value] ( env=value) . . = *value* env . env ENV Containerfile . --unsetenv . --file, -f=Containerfile Containerfile URL http https. Containerfile FROM . Containerfile (context directory) . -f - Containerfile (stdin) . --force-compression . --compression-format compression_format containers.conf true false . --force-rm ( false ). --format . oci ( OCI image-spec v1.0 ) docker ( 2 2 ) . : BUILDAH_FORMAT . export BUILDAH_FORMAT=docker --from FROM Containerfile . FROM Containerfile . --group-add=group | keep-groups . o keep-groups Podman (supplementary group access) . . (rootless) OCI . OCI crun . : keep-groups . --help, -h (usage statement) --hooks-dir=path *.json (hook) podman . JSON oci- hooks(5) . Podman 1.0.0 0.1.0 0.1.0 . ( oci-hooks(5) ). (annotation conditions) podman OCI . (bind-mount conditions) --volume . podman ( /dev/shm) . --hooks-dir (root) Podman /usr/share/containers/oci/hooks.d /etc/containers/oci/hooks.d . --hooks-dir . --http-proxy podman . --http- proxy false . http_proxy https_proxy ftp_proxy no_proxy . --identity-label io.podman.version podman ( true --timestamp --source-date-epoch ). --ignorefile .containerignore (.dockerignore) . --iidfile=ImageIDfile . --platform . --iidfile-raw=ImageIDfile ( sha256:) . --platform . --raw-iidfile . --inherit-annotations=bool-value (annotations) ( true ). false --created- annotation . --inherit-labels (labels) ( true ). --ipc=how IPC RUN . "" ( ) "container" IPC "host" IPC podman IPC . --isolation=type RUN . oci ( OCI ) rootless ( OCI --no-new-keyring create UTS IPC PID (mount) ) chroot ( chroot(1) (cgroup) IPC PID mount UTS ) . : BUILDAH_ISOLATION . export BUILDAH_ISOLATION=oci --jobs=number N . 1 stdin /dev/null . 0 . --label=label label ( label=value) . . label = value label . LABEL io.containers.capabilities=CAP1,CAP2,CAP3 Containerfile (capabilities) . Podman . . . --layer-label=label[=value] label ( label=value) --layers true . . label = value label . --layers ( false ). : BUILDAH_LAYERS . export BUILDAH_LAYERS=true --logfile=filename . --logsplit=bool-value --logfile --platform ${logfile}_${platform-os}_${platform-arch} . --manifest=manifest . . . listName localhost . --memory, -m=number[unit] (: [] = b k m g ) . swap -m RAM . 0 ( -m) . (page size) ( ). --memory-swap=number[unit] swap. -m (--memory) . LIMIT swap -m (--memory) . LIMIT --memory . LIMIT [] . b () k () m () g () . b . swap LIMIT -1 . --metadata-file=MetadataFile . --platform . --mount=mount-specification RUN Containerfile . : podman build --mount type=secret,id=mysecret ... Containerfile : RUN cat /run/secrets/mysecret : RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret --network=mode, --net RUN . mode : o none: . --dns --dns-option --dns-search o host: . : host D-Bus o ns:path: o private: () o : --network mynet mynet. (rootful) . o pasta[:OPTIONS,...]: pasta(1) (user-mode). (rootless) . IPv4 IPv6 (pod interface) . ( init ) . IP . pasta(1) . pasta(1) --config-net --no-map-gw () . --map-gw pasta ( pasta(1) ). -t none -u none . -T none -U none . : o pasta:--map-gw: . o pasta:--mtu,1500: MTU tap . o pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns- forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp IPv6 10.0.2.0/24 tap0 10.0.2.2 DNS 10.0.2.3 MTU NDP DHCPv6 DHCP. o pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns- forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp MTU o pasta:-t,auto,-u,auto,-T,auto,-U,auto: o pasta:-T,5201: TCP 5201 loopback tap --no-cache . . --no-hostname /etc/hostname RUN . Podman /etc/hostname . --no- hostname /etc/hostname ( ) . --no-hosts /etc/hosts RUN . Podman /etc/hosts IP . --no-hosts /etc/hosts . --add-host . --omit-history ( false). --omit-history History History . --os=string . --os-feature=feature (feature) . scratch ( ) . . feature - feature . --os-version=version (version) . scratch ( ) . . --output, -o=output-opts (: type=local,dest=path) --output ( -o) . --output = (key=value) . (keys) : dest: . - . type: . . type : local: . tar: (.tar). --output ( **dest**) ( --output some-path --output -) - (type) tar local . (Timestamps) --timestamp --source-date-epoch ( ) . --tag containers-transports(5) . --pid=pid PID RUN . "" ( ) "private" PID "host" PID podman PID . --platform=os/arch[/variant][,...] OS/ARCH ( ) ( linux/arm linux/arm64 linux/amd64). --platform . --manifest --tag . OS/ARCH Go . ARCH arch . $GOOS $GOARCH https://golang.org/doc/install/source#environment go tool dist list . podman build (non-native) . RUN qemu-user-static . : . : --platform --arch --os --variant . --pull=policy (pull) . missing . --pull always . o always: SBOM registries.conf . SBOM . o missing: SBOM . . o never: SBOM . . o newer: SBOM registries.conf . SBOM . --quiet, -q () . --retry=attempts (push/pull) / . 3 . --retry-delay=duration (push/pull) / . 2s . --rewrite-timestamp (timestamp) --source-date-epoch ( ) . --rm ( true). --runtime=path (path) (runtime) OCI RUN . runc crun cgroups V2 . : BUILDAH_RUNTIME . export BUILDAH_RUNTIME=/usr/bin/crun --runtime-flag=flag . (man pages) . : -- . runc --log-format json podman build --runtime-flag log-format=json . --save-stages --stage-labels ( ) . --sbom=preset / SBOM (Software Bills Of Materials) (build contexts) . --sbom-image-output --sbom- image-purl-output --sbom-output --sbom-purl-output . (presets) : o "syft", "syft-cyclonedx": --sbom-scanner-image=ghcr.io/anchore/syft --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output cyclonedx-json={OUTPUT}" --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output cyclonedx-json={OUTPUT}" --sbom-merge-strategy=merge-cyclonedx-by-component-name-and- version o "syft-spdx": --sbom-scanner-image=ghcr.io/anchore/syft --sbom-scanner-command="/syft scan -q dir:{ROOTFS} --output spdx-json={OUTPUT}" --sbom-scanner-command="/syft scan -q dir:{CONTEXT} --output spdx-json={OUTPUT}" --sbom-merge-strategy=merge-spdx-by-package-name-and- versioninfo o "trivy", "trivy-cyclonedx": --sbom-scanner-image=ghcr.io/aquasecurity/trivy --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format cyclonedx --output {OUTPUT}" --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format cyclonedx --output {OUTPUT}" --sbom-merge-strategy=merge-cyclonedx-by-component-name-and- version o "trivy-spdx": --sbom-scanner-image=ghcr.io/aquasecurity/trivy --sbom-scanner-command="trivy filesystem -q {ROOTFS} --format spdx-json --output {OUTPUT}" --sbom-scanner-command="trivy filesystem -q {CONTEXT} --format spdx-json --output {OUTPUT}" --sbom-merge-strategy=merge-spdx-by-package-name-and- versioninfo --sbom-image-output=path SBOM (SBOM) . . --sbom-image-purl-output=path SBOM PURL ( / package URL ) PURL . . --sbom-merge-strategy=method --sbom-scanner- command . : o cat () . o merge-cyclonedx-by-component-name-and-version "component" JSON "name" "version" . . o merge-spdx-by-package-name-and-versioninfo "package" JSON "name" "versionInfo" . . --sbom-output=file SBOM (SBOM) . . --sbom-purl-output=file SBOM PURL ( / package URL ) PURL . . --sbom-scanner-command=image SBOM . . : - {ROOTFS} bind mount. - {CONTEXT} (build context) bind mount. - {OUTPUT} . --sbom-scanner-image=image SBOM . --secret=id=id[,src=envOrFile][,env=ENV][,type=file | env] ( / secret) Containerfile . "id" "src" ( ) "env" . () /run/secrets/ (mount) . --mount RUN Containerfile : RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret "target" "dst" "destination" RUN --mount . RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret : RUN --mount=type=secret,id=mysecret,env=FOO sh -c 'echo "Hello $FOO"' : . --security-opt=option "apparmor=unconfined" : apparmor "apparmor=your-profile" : (profile) apparmor "label=user:USER" : "label=role:ROLE" : "label=type:TYPE" : "label=level:LEVEL" : "label=disable" : "mask=/path/1:/path/2": . . "no-new-privileges" : "seccomp=unconfined" : seccomp "seccomp=profile.json : JSON seccomp "unmask=ALL /path/1:/path/2 (/proc/*): . ALL . /proc/acpi, /proc/interrupts, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/devices/virtual/powercap, /sys/firmware /sys/fs/selinux. /proc/asound /proc/bus /proc/fs /proc/irq /proc/sys /proc/sysrq-trigger. --shm-size=number[unit] /dev/shm. . number 0 . b () k () m () g () . . 64m . --sign-by=fingerprint GPG (fingerprint) . --skip-unused-stages ( true ). --source-date-epoch=seconds << >> (created) (Unix epoch 00:00:00 UTC ) ( SOURCE_DATE_EPOCH ). <> (commit) sha256 Containerfile (build context) . (build arg) SOURCE_DATE_EPOCH . <> . --output . --timestamp . --source-policy-file=pathname JSON (source policy) BuildKit . ( FROM) . ( ) Containerfile . (build reproducibility) . JSON . : - action: . : - ALLOW: ( ). - DENY: . - CONVERT: updates. - selector: . - identifier: ( docker- image://docker.io/library/alpine:latest). - matchType: . EXACT WILDCARD ( glob * ?). WILDCARD . - updates: CONVERT . . . : CONVERT --build-context containers- registries.conf(5) . : --build-context registries.conf. alpine:latest : { "rules": [ { "action": "CONVERT", "selector": { "identifier": "docker-image://docker.io/library/alpine:latest" }, "updates": { "identifier": "docker-image://docker.io/library/alpine@sha256:..." } } ] } ubuntu : { "rules": [ { "action": "DENY", "selector": { "identifier": "docker-image://docker.io/library/ubuntu:*", "matchType": "WILDCARD" } } ] } --squash () (squash) . ( false ). Podman . --layers . --squash-all ( ) . --ssh=default | id[=socket> SSH . default=$SSH_AUTH_SOCK . ssh --mount RUN Containerfile : RUN --mount=type=secret,id=id mycmd : root mode uid gid mount . ssh app uid=50000: # Switch to application user (Note that uid depends on container image) USER app # ...and check whether ssh identities are available RUN --mount=type=ssh,uid=50000 ssh-add -L --stage-labels ( false ). --save-stages . : - io.podman.stage.name: ( FROM ... AS alias) - io.podman.stage.base: (pullspec ) . --stdin (stdin) RUN. RUN Containerfile apt . --stdin . --tag, -t=imageName . imageName localhost . --tag containers-transports(5) . containers- storage ( ) . podman build --tag=oci-archive:./foo.ociarchive . podman build -t quay.io/username/foo . --target=stageName () . Containerfile --target . . --timestamp=seconds << >> (created) (Unix epoch 00:00:00 UTC ) ( ). <> (commit) sha256 Containerfile (build context) . --timestamp <> . --timestamp --output . --source-date-epoch . --tls-verify HTTPS ( true ) HTTPS ADD. TLS . --ulimit=type=soft-limit[:hard-limit] RUN . . : "core": (core dump) ( ulimit -c) "cpu": CPU ( ulimit -t) "data": (data segment) ( ulimit -d) "fsize": (ulimit -f) "locks": (ulimit -x) "memlock": (ulimit -l) "msgqueue": (ulimit -q) "nice": niceness ( nice -n ulimit -e) "nofile": (ulimit -n) "nofile": (1048576) root "nproc": (ulimit -u) "nproc": (1048576) root "rss": (RSS) ( ulimit -m) "rtprio": (real-time) ( ulimit -r) "rttime": "sigpending": (ulimit -i) "stack": (stack) ( ulimit -s) --unsetannotation=annotation (annotation) . --unsetenv=env . --unsetlabel=label (label) . --userns=how (user namespaces) RUN . "" ( ) "private" "auto" "host" podman . auto: . --userns=auto containers (subordinate user IDs) /etc/subuid /etc/subgid . : containers:2147483647:2147483648. Podman UID GID containers . UID . UID GID size . auto: o gidmapping=CONTAINER_GID:HOST_GID:SIZE: GID . o size=SIZE: --userns=auto:size=8192. size auto . o uidmapping=CONTAINER_UID:HOST_UID:SIZE: UID . --userns-gid-map=mapping GID . RUN (user namespace) UID GID . GID GID (ID) . remap-gids options /etc/containers/storage.conf . --userns-gid-map . --userns-gid-map-group=group GID /etc/subgid . RUN UID GID . --userns-uid-map-user --userns-gid-map-group podman . --userns-gid-map podman(1) . : (rootless) (rootful) . --userns-uid-map=mapping UID . RUN UID GID . UID UID . remap-uids options /etc/containers/storage.conf . --userns-uid-map . --userns-uid-map-user=user UID /etc/subuid . RUN UID GID . --userns-gid-map-group --userns-uid-map-user podman . : (rootless) (rootful) . --uts=how UTS RUN . "" ( ) "container" UTS "host" UTS podman UTS . --variant=VARIANT (variant) . --volume, -v=[HOST-DIR:CONTAINER-DIR[:OPTIONS]] RUN (mount) . OPTIONS : o [rw|ro] o [U] o [z|Z|O] o [[r]shared|[r]slave|[r]private] [1] <#Footnote1> CONTAINER-DIR /src/docs . HOST- DIR . Podman HOST-DIR bind-mount . /foo Podman /foo bind-mount . -v . (Write Protected Volume Mounts) :ro :rw - . - . . (Chowning Volume Mounts) Podman . (user namespace) UID GID UID GID . :U Podman UID GID UID GID . (Labeling Volume Mounts) SELinux . . Podman . :z :Z . Podman . z Podman . Podman . / . Z Podman . . (Overlay Volume Mounts) :O Podman Overlay . RUN . (Overlay FS) (lower) (upper) . RUN tmpfs. RUN RUN . overlay (package cache) . : o O Z z . . SELinux . SELinux . o overlay . . bind mount private . . (propagation property) . shared . slave . :[r]shared :[r]slave :[r]private . bind mount . ( ) . shared shared . slave shared slave . [1] <#Footnote1> df findmnt -o TARGET,PROPAGATION findmnt /proc/self/mountinfo . optional fields . shared:X shared master:X slave private . [1] <#Footnote1> mount . bind mount /foo mount --bind /foo /foo mount --make- private --make-shared /foo . /foo shared . . / /foo mount --make-shared / / shared . (BUILD TIME VARIABLES) ENV Containerfile . . Containerfile Containerfile . --build-arg Containerfile ENV (override) . o HTTP_PROXY o HTTPS_PROXY o FTP_PROXY o NO_PROXY <#using-build-time-variables> . (EXAMPLES) Containerfile (Build an image using local Containerfiles) podman build . podman build -f Containerfile . cat ~/Containerfile | podman build -f - . podman build -f Containerfile.simple -f Containerfile.notsosimple . podman build --timestamp=$(date '+%s') -t imageName . podman build -t imageName . podman build --tls-verify=true -t imageName -f Containerfile.simple . podman build --tls-verify=false -t imageName . podman build --runtime-flag log-format=json . podman build -f Containerfile --runtime-flag debug . podman build --authfile /tmp/auths/myauths.json --cert-dir ~/auth --tls-verify=true --creds=username:password -t imageName -f Containerfile.simple . podman build --memory 40m --cpu-period 10000 --cpu-quota 50000 --ulimit nofile=1024:1028 -t imageName . podman build --security-opt label=level:s0:c100,c200 --cgroup-parent /path/to/cgroup/parent -t imageName . podman build --arch=arm --variant v7 -t imageName . podman build --volume /home/test:/myvol:ro,Z -t imageName . podman build -v /home/test:/myvol:z,U -t imageName . podman build -v /var/lib/dnf:/var/lib/dnf:O -t imageName . podman build --layers -t imageName . podman build --save-stages -t imageName . podman build --save-stages --layers -t imageName . podman build --save-stages --stage-labels -t imageName . podman build --save-stages --stage-labels --layers -t imageName . podman build --no-cache -t imageName . podman build -f Containerfile --layers --force-rm -t imageName . podman build --no-cache --rm=false -t imageName . podman build --dns-search=example.com --dns=223.5.5.5 --dns-option=use- vc . podman build -f Containerfile.in --cpp-flag="-DDEBUG" -t imageName . podman build --network mynet . podman build --env LANG=en_US.UTF-8 -t imageName . podman build --env EDITOR -t imageName . podman build --unsetenv LANG -t imageName . podman build --os-version 10.0.19042.1645 -t imageName . podman build --os-feature win32k -t imageName . podman build --os-feature win32k- -t imageName . podman build --secret=id=mysecret . podman build --secret=id=mysecret,env=MYSECRET . podman build --secret=id=mysecret,src=MYSECRET,type=env . podman build --secret=id=mysecret,src=.mysecret,type=file . podman build --secret=id=mysecret,src=.mysecret . (Building an image with a source policy) podman build --source-policy-file /etc/podman/source-policy.json -t imageName . FROM --after (Using FROM --after for explicit stage dependencies) FROM oci- archive:file.ociarchive Podman . --after FROM : FROM quay.io/skopeo/stable AS builder RUN --mount=type=bind,target=/src,rw skopeo copy docker://quay.io/fedora/fedora-minimal oci-archive:/src/fedora.ociarchive FROM --after=builder oci-archive:fedora.ociarchive # FROM builder --manifest ( ) podman build --arch arm --manifest myimage /tmp/mysrc podman build --arch amd64 --manifest myimage /tmp/mysrc podman build --arch s390x --manifest myimage /tmp/mysrc podman bud --platform linux/s390x,linux/ppc64le,linux/amd64 --manifest myimage /tmp/mysrc podman build --platform linux/arm64 --platform linux/amd64 --manifest myimage /tmp/mysrc podman bud --all-platforms --manifest myimage /tmp/mysrc (--output) podman build -o out . podman build --output type=local,dest=out . podman build --output type=tar,dest=out.tar . podman build -o - . > out.tar (Preserving and querying intermediate stage images) : podman build --save-stages --stage-labels -t myapp . : podman images --filter "label=io.podman.stage.name=builder" : podman images --filter "label=io.podman.stage.base=golang:1.21" (Building an image using a URL) URL (clone) (context) . Containerfile Dockerfile . . podman build https://github.com/containers/PodmanHello.git : (https://github.blog/2021-09-01-improving- git-protocol-security-github) git:// clone . URL https:// . URL (tarball) Podman . Containerfile Dockerfile . -f PATH/Containerfile . podman build -f dev/Containerfile https://10.10.10.1/podman/context.tar.gz : 'xz' 'bzip2' 'gzip' 'identity' ( ). (Using Build Time Variables) HTTP_PROXY Containerfile podman build --build-arg=HTTP_PROXY="http://127.0.0.1:8321" (ENVIRONMENT) BUILD_REGISTRY_SOURCES BUILD_REGISTRY_SOURCES JSON insecureRegistries blockedRegistries allowedRegistries . (pull) blockedRegistries . allowedRegistries . TMPDIR TMPDIR (pull) (push) . '/var/tmp' . (FILES) .containerignore/.dockerignore .containerignore/.dockerignore podman build . .containerignore . --ignorefile . Podman COPY ADD Containerfile/Dockerfile . COPY ADD --exclude . (Unix shell globs) .containerignore/.dockerignore / . Podman ** ( ) . **/*.go .go . .containerignore: # */*.c **/output* src */*.c .c . include/rootless.c. **/output* output . src src src . ! ( ) . .containerignore/.dockerignore : *.doc !Help.doc doc. Help.doc . .containerignore : https://github.com/containers/common/blob/main/docs/containerignore.5.md : ADD .containerignore . registries.conf (/etc/containers/registries.conf) registries.conf . policy.json (/etc/containers/policy.json) . . . (SEE ALSO) podman(1), cpp(1), podman-login(1), docker-login(1), namespaces(7), pid_namespaces(7), containers-policy.json(5), containers- registries.conf(5), user_namespaces(7), crun(1), runc(8), containers.conf(5), oci-hooks(5), containers-transports(5), containers- auth.json(5) (FOOTNOTES) 1: Podman () . (mount propagation) master slave . . Podman . (EXAMPLES) overlay : $ podman build -v /var/lib/yum:/var/lib/yum:O -t imageName . : $ podman build --layers --force-rm -t imageName . : $ podman build --no-cache --rm=false -t imageName . : $ podman build --network mynet . mysecret: $ podman build --secret=id=mysecret . MYSECRET: $ podman build --secret=id=mysecret,env=MYSECRET . $ podman build --secret=id=mysecret,src=MYSECRET,type=env . --manifest ( ) : $ podman build --arch arm --manifest myimage /tmp/mysrc $ podman build --arch amd64 --manifest myimage /tmp/mysrc $ podman build --arch s390x --manifest myimage /tmp/mysrc : $ podman build --platform linux/s390x,linux/ppc64le,linux/amd64 --manifest myimage /tmp/mysrc URL Git URL Containerfile Git . Git . Git $ podman build -t hello https://github.com/containers/PodmanHello.git $ podman run hello $ podman build -f dev/Containerfile https://10.10.10.1/podman/context.tar.gz (FILES) .containerignore/.dockerignore .containerignore .dockerignore podman build . --ignorefile . registries.conf (/etc/containers/registries.conf) . containers- registries.conf(5) (TROUBLESHOOTING) lastlog useradd Containerfile UID/GID /var/log/lastlog . --no-log-init -l useradd . (SEE ALSO) podman(1), buildah(1), containers-certs.d(5), containers- registries.conf(5), crun(1), runc(8), useradd(8), podman-ps(1), podman- rm(1), Containerfile(5), containerignore(5) (HISTORY) Tom Sweeney Dan Walsh . podman-build(1)