podman-container.unit(5) File Formats Manual podman-container.unit(5) (NAME) podman-container.unit - systemd Podman Quadlet (SYNOPSIS) name.container (DESCRIPTION) .container [Container] . ExecStart=podman run ... image- name Podman . systemd . Podman systemd- $name.container $name.service Podman systemd-$name . ContainerName . Image . (USAGE SUMMARY) .container (reload) podman- system-generator .service systemd podman run . : systemctl --user start myimage-container.service (OPTIONS) [Container] : +----------------------------------------+----------------------------------------+ | [Container] | podman run | +----------------------------------------+----------------------------------------+ |AddCapability=CAP | --cap-add CAP | +----------------------------------------+----------------------------------------+ |AddDevice=/dev/foo | --device /dev/foo | +----------------------------------------+----------------------------------------+ |AddHost=example.com:192.168.10.11 | --add-host example.com:192.168.10.11 | +----------------------------------------+----------------------------------------+ |Annotation="XYZ" | --annotation "XYZ" | +----------------------------------------+----------------------------------------+ |AutoUpdate=registry | --label | | | "io.containers.autoupdate=registry" | +----------------------------------------+----------------------------------------+ |CgroupsMode=no-conmon | --cgroups=no-conmon | +----------------------------------------+----------------------------------------+ |ContainerName=name | --name name | +----------------------------------------+----------------------------------------+ |ContainersConfModule=/etc/nvd.conf | --module=/etc/nvd.conf | +----------------------------------------+----------------------------------------+ |DNS=192.168.55.1 | --dns=192.168.55.1 | +----------------------------------------+----------------------------------------+ |DNSOption=ndots:1 | --dns-option=ndots:1 | +----------------------------------------+----------------------------------------+ |DNSSearch=example.com | --dns-search example.com | +----------------------------------------+----------------------------------------+ |DropCapability=CAP | --cap-drop=CAP | +----------------------------------------+----------------------------------------+ |Entrypoint=/foo.sh | --entrypoint=/foo.sh | +----------------------------------------+----------------------------------------+ |Environment=foo=bar | --env foo=bar | +----------------------------------------+----------------------------------------+ |EnvironmentFile=/tmp/env | --env-file /tmp/env | +----------------------------------------+----------------------------------------+ |EnvironmentHost=true | --env-host | +----------------------------------------+----------------------------------------+ |Exec=/usr/bin/command | | | | - | | | /usr/bin/command | +----------------------------------------+----------------------------------------+ |ExposeHostPort=50-59 | --expose 50-59 | +----------------------------------------+----------------------------------------+ |GIDMap=0:10000:10 | --gidmap=0:10000:10 | +----------------------------------------+----------------------------------------+ |GlobalArgs=--log-level=debug | --log-level=debug | +----------------------------------------+----------------------------------------+ |Group=1234 | --user UID:1234 | +----------------------------------------+----------------------------------------+ |GroupAdd=keep-groups | --group-add=keep-groups | +----------------------------------------+----------------------------------------+ |HealthCmd=/usr/bin/command | --health-cmd=/usr/bin/command | +----------------------------------------+----------------------------------------+ |HealthInterval=2m | --health-interval=2m | +----------------------------------------+----------------------------------------+ |HealthLogDestination=/foo/log | --health-log-destination=/foo/log | +----------------------------------------+----------------------------------------+ |HealthMaxLogCount=5 | --health-max-log-count=5 | +----------------------------------------+----------------------------------------+ |HealthMaxLogSize=500 | --health-max-log-size=500 | +----------------------------------------+----------------------------------------+ |HealthOnFailure=kill | --health-on-failure=kill | +----------------------------------------+----------------------------------------+ |HealthRetries=5 | --health-retries=5 | +----------------------------------------+----------------------------------------+ |HealthStartPeriod=1m | --health-start-period=1m | +----------------------------------------+----------------------------------------+ |HealthStartupCmd=command | --health-startup-cmd=command | +----------------------------------------+----------------------------------------+ |HealthStartupInterval=1m | --health-startup-interval=1m | +----------------------------------------+----------------------------------------+ |HealthStartupRetries=8 | --health-startup-retries=8 | +----------------------------------------+----------------------------------------+ |HealthStartupSuccess=2 | --health-startup-success=2 | +----------------------------------------+----------------------------------------+ |HealthStartupTimeout=1m33s | --health-startup-timeout=1m33s | +----------------------------------------+----------------------------------------+ |HealthTimeout=20s | --health-timeout=20s | +----------------------------------------+----------------------------------------+ |HostName=example.com | --hostname example.com | +----------------------------------------+----------------------------------------+ |HttpProxy=true | --http-proxy=true | +----------------------------------------+----------------------------------------+ |Image=ubi8 | - ubi8 | +----------------------------------------+----------------------------------------+ |ImageVolume=tmpfs | --image-volume tmpfs | +----------------------------------------+----------------------------------------+ |IP=192.5.0.1 | --ip 192.5.0.1 | +----------------------------------------+----------------------------------------+ |IP6=2001:db8::1 | --ip6 2001:db8::1 | +----------------------------------------+----------------------------------------+ |Label="XYZ" | --label "XYZ" | +----------------------------------------+----------------------------------------+ |LogDriver=journald | --log-driver journald | +----------------------------------------+----------------------------------------+ |LogOpt=path=/var/log/mykube.json | --log-opt path=/var/log/mykube.json | +----------------------------------------+----------------------------------------+ |Mask=/proc/sys/foo:/proc/sys/bar | --security-opt | | | mask=/proc/sys/foo:/proc/sys/bar | +----------------------------------------+----------------------------------------+ |Memory=20g | --memory 20g | +----------------------------------------+----------------------------------------+ |Mount=type=... | --mount type=... | +----------------------------------------+----------------------------------------+ |Network=host | --network host | +----------------------------------------+----------------------------------------+ |NetworkAlias=name | --network-alias name | +----------------------------------------+----------------------------------------+ |NoNewPrivileges=true | --security-opt no-new-privileges | +----------------------------------------+----------------------------------------+ |Notify=true | --sdnotify container | +----------------------------------------+----------------------------------------+ |PidsLimit=10000 | --pids-limit 10000 | +----------------------------------------+----------------------------------------+ |Pod=pod-name | --pod=pod-name | +----------------------------------------+----------------------------------------+ |PodmanArgs=--publish 8080:80 | --publish 8080:80 | +----------------------------------------+----------------------------------------+ |PublishPort=8080:80 | --publish 8080:80 | +----------------------------------------+----------------------------------------+ |Pull=never | --pull never | +----------------------------------------+----------------------------------------+ |ReadOnly=true | --read-only | +----------------------------------------+----------------------------------------+ |ReadOnlyTmpfs=true | --read-only-tmpfs | +----------------------------------------+----------------------------------------+ |ReloadCmd=/usr/bin/command | ExecReload | | | exec | | | | +----------------------------------------+----------------------------------------+ |ReloadSignal=SIGHUP | ExecReload | | | kill | | | | +----------------------------------------+----------------------------------------+ |Retry=5 | --retry=5 | +----------------------------------------+----------------------------------------+ |RetryDelay=5s | --retry-delay=5s | +----------------------------------------+----------------------------------------+ |Rootfs=/var/lib/rootfs | --rootfs /var/lib/rootfs | +----------------------------------------+----------------------------------------+ |RunInit=true | --init | +----------------------------------------+----------------------------------------+ |SeccompProfile=/tmp/s.json | --security-opt seccomp=/tmp/s.json | +----------------------------------------+----------------------------------------+ |Secret=secret | --secret=secret[,opt=opt ...] | +----------------------------------------+----------------------------------------+ |SecurityLabelDisable=true | --security-opt label=disable | +----------------------------------------+----------------------------------------+ |SecurityLabelFileType=usr_t | --security-opt label=filetype:usr_t | +----------------------------------------+----------------------------------------+ |SecurityLabelLevel=s0:c1,c2 | --security-opt label=level:s0:c1,c2 | +----------------------------------------+----------------------------------------+ |SecurityLabelNested=true | --security-opt label=nested | +----------------------------------------+----------------------------------------+ |SecurityLabelType=spc_t | --security-opt label=type:spc_t | +----------------------------------------+----------------------------------------+ |ShmSize=100m | --shm-size=100m | +----------------------------------------+----------------------------------------+ |StartWithPod=true | Pod= | | | | | | | | | | | | | | | | +----------------------------------------+----------------------------------------+ |StopSignal=SIGINT | --stop-signal=SIGINT | +----------------------------------------+----------------------------------------+ |StopTimeout=20 | --stop-timeout=20 | +----------------------------------------+----------------------------------------+ |SubGIDMap=gtest | --subgidname=gtest | +----------------------------------------+----------------------------------------+ |SubUIDMap=utest | --subuidname=utest | +----------------------------------------+----------------------------------------+ |Sysctl=name=value | --sysctl=name=value | +----------------------------------------+----------------------------------------+ |Timezone=local | --tz local | +----------------------------------------+----------------------------------------+ |Tmpfs=/work | --tmpfs /work | +----------------------------------------+----------------------------------------+ |UIDMap=0:10000:10 | --uidmap=0:10000:10 | +----------------------------------------+----------------------------------------+ |Ulimit=nofile=1000:10000 | --ulimit nofile=1000:10000 | +----------------------------------------+----------------------------------------+ |Unmask=ALL | --security-opt unmask=ALL | +----------------------------------------+----------------------------------------+ |User=bin | --user bin | +----------------------------------------+----------------------------------------+ |UserNS=keep-id:uid=200,gid=210 | --userns keep-id:uid=200,gid=210 | +----------------------------------------+----------------------------------------+ |Volume=/source:/dest | --volume /source:/dest | +----------------------------------------+----------------------------------------+ |WorkingDir=$HOME | --workdir $HOME | +----------------------------------------+----------------------------------------+ [Container] : AddCapability=capability (Linux capabilities). (confinement) . CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_MKNOD CAP_SYS_MODULE (user namespace) . user_namespaces(7) . . capabilities(7) . AddDevice=host-device[:container-device][:permissions] . HOST-DEVICE[:CONTAINER-DEVICE][:PERMISSIONS] HOST-DEVICE (device node) CONTAINER-DEVICE PERMISSIONS <> <> <> mknod(2) . : --device=/dev/sdc:/dev/xvdc:rwm. : host-device (symbolic link) (resolve) . (major minor) . . : /dev/fuse. (rootless) bind mount . bind SELinux SELinux (permission denied) . SELinux : $ sudo setsebool -P container_use_devices=true AddHost=hostname[;hostname[;...]]:ip IP /etc/hosts . - IPv4 IPv6 ( ). IP /etc/hosts ( --name --hostname ). /etc/hosts . --no-hosts no_hosts=true containers.conf . IP host- gateway . IP . IP host-gateway . IP host_containers_internal_ip containers.conf . host-gateway host.containers.internal host.docker.internal /etc/hosts . --no-hosts host_containers_internal_ip="none" containers.conf . host-gateway IP /etc/hosts . podman machine ( ) /etc/hosts IP DNS gvproxy . /etc/hosts /etc/hosts . base_hosts_file containers.conf . Annotation=key=value (annotation) . . AutoUpdate=registry (podman-auto-update(1)). : o registry: ( quay.io/podman/stable:latest) . (pull) . / . o local: . systemd (restart) . CgroupsMode=how cgroup . cgroups Quadlet split (enabled) Podman . ( Pod= ) no-conmon enabled cgroup . enabled cgroup cgroup-parent . disabled cgroup cgroup (--cgroupns --cgroup-parent) . no-conmon cgroup conmon . split cgroup cgroup : conmon (container payload). --cgroup-parent split . ContainerName=name . : o UUID ( <>) o UUID ( <>) o ( <>). UUID ContainerName= exciting_chebyshev ( _ ) . . (underscore) . DNS exciting_chebyshev. . . IP /etc/hosts ( AddHost= ). (hostname) HostName= . DNS podman- network(1) . ContainersConfModule=module containers.conf(5). . DNS=ipaddr DNS . DNS . DNS ( 127.0.0.1). DNS=. . none /etc/resolv.conf . /etc/resolv.conf . ipaddr /etc/resolv.conf . dns_enabled true --network /etc/resolv.conf aardvark-dns . aardvark-dns ipaddr . DNSOption=option DNS. DNSOption= Network= none container:id . DNSSearch=domain DNS. DNSSearch= Network= none container:id . DNSSearch=. . DropCapability=capability all . . Entrypoint="command" ENTRYPOINT . (ENTRYPOINT) COMMAND () . ENTRYPOINT . ENTRYPOINT (binary) . COMMAND . Entrypoint= ENTRYPOINT . JSON . Environment=env=value [env=value ...] . . . * . EnvironmentFile=file . EnvironmentHost= . Environment . ( Podman ( WSL2) ). Exec=command podman run . systemd systemd ExecStart= ENTRYPOINT CMD . ENTRYPOINT . args Kubernetes . ExposeHostPort=port[/protocol] (expose) () ( Expose=3300-3310). tcp udp sctp tcp . EXPOSE -P/--publish-all . PublishPort= . GIDMap=[flags]container_gid:from_gid[:amount] GID . UserNS= SubGIDMap= . GID GID --uidmap UID UID . --uidmap . : GIDMap= Pod= gidmap . GlobalArgs= podman . (generator) . . . . Group=gid GID () . GID ( UserNS ) GID . GroupAdd=group | keep-groups . o keep-groups (supplementary group access) . . OCI . OCI crun . : keep- groups . ( ( WSL2) ). HealthCmd="command" (healthcheck) . . . none . JSON /bin/sh -c . : . HealthInterval=interval . disable . 30s . : . HealthLogDestination=directory_path (HealthCheck log). local events_logger ( local ) (: local). o local: () HealthCheck overlay ( : $runroot/healthcheck.log). o directory: -healthcheck.log HealthCheck . o events_logger: events_logger . . HealthMaxLogCount=number HealthCheck ( <<0>> ) (: ). HealthMaxLogSize=size HealthCheck () ( <<0>> ) (: ). HealthOnFailure=action (unhealthy) . none . o none: . o kill: (kill). o restart: (restart). restart --restart . systemd systemd kill stop . o stop: (stop). HealthRetries=retries . 3 . : . HealthStartPeriod=period (bootstrap) . 2m3s . 0s . : healthy . starting HealthStartPeriod= . HealthStartPeriod= unhealthy . HealthInterval= . : . HealthStartupCmd="command" . ( ) . . . . ( HealthCmd=) . HealthStartupInterval=interval . disable . 30s . HealthStartupRetries=retries . 0 . 0 . HealthStartupSuccess=retries . 0 . 0 . HealthStartupTimeout=timeout . 2m3s . 30s . HealthTimeout=timeout . start-period 1m22s . 30s . : (timeout) . timeout SIGKILL . : . HostName=name . UTS --uts=private () . Pod= UTS () . IP /etc/hosts ( AddHost= ). HostName= UTS () . ContainerName= container_name_as_hostname=true containers.conf . ( ) --hostname DNS . . podman-network(1) . HttpProxy= . false . http_proxy https_proxy ftp_proxy no_proxy . . ( --env (hardcode) ). . true . Image=name . (fully qualified) . podman pull . :tag (digests) . : o name .image Quadlet .image systemd $name-image.service ( .image) . .image . o name .build Quadlet .build systemd $name-build.service . : .build . ImageVolume=mode (builtin) . bind . o bind: (mount) . o tmpfs: tmpfs . o ignore: . IP=IPv4 IPv4 10.88.64.128. - Network=network-name - Network=container:id . IP ( 10.88.0.0/16). IP Network= IP ip . IP6=IPv6 IPv6 fd46:db93:aa76:ac37::10. - Network=network- name - Network=container:id . IPv6 . IPv6 Network= IPv6 ip6 . Label=key=value [key=value ...] . LogDriver=driver (logging driver) . k8s-file journald none passthrough passthrough-tty json-file k8s-file ( journald). podman info . $ podman info --format '{{ .Host.LogDriver }}' journald passthrough (stdin stdout stderr) . Podman ( WSL2) tty TIOCSTI . passthrough-tty passthrough TTY . LogOpt=name=value . . *name* : path: ( LogOpt=path=/var/log/container/mycontainer.json) max-size: ( LogOpt=max-size=10mb) tag: ( LogOpt=tag="{{.ImageName}}". podman inspect --format . journald ). label: (label) ( --log-opt label="CONTAINER_IMAGE={{.ImageName}}". podman inspect --format . . journald ). Mask=/path/1:/path/2 : Mask=/path/1:/path/2. . Memory=number[unit] . unit b () k () m () g () . . swap Memory= RAM . 0 ( Memory=) . (page size) ( ). cgroups V1 . Mount=type=TYPE,TYPE-SPECIFIC-OPTION[,...] (filesystem mount) . : o type=volume source .volume .volume . o type=image source .image .image . systemd . : .volume .image . TYPE : artifact bind devpts glob image ramfs tmpfs volume. mount: o src source: bind glob volume. artifact bind glob image. volume . o dst dest destination target: . (source globs) . . type=glob,src=/foo*,destination=/tmp/bar /foo* /tmp/bar/ . type=artifact: o digest: (blob) (digest) . o title: org.opencontainers.image.title . o name: . dst . -x x 0 . src . dst ( org.opencontainers.image.title) . . . dst . digest title . dst . dst . type=volume: o ro, readonly: true false ( : false). o U, chown: true false ( : false). UID GID . o subpath: (mount) . o relabel: shared, private. ( SELinux) . shared private . o z, Z: relabel=shared relabel=private . o idmap: idmapped . idmap (rootful) . idmapped . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10. . . # . '@' . . type=image: o rw, readwrite: true false ( : false). o subpath: (mount) . bind glob: o ro, readonly: true false ( : false). o bind-propagation: shared slave private unbindable rshared rslave runbindable rprivate ().[1] <#Footnote1> mount(2) . o bind-nonrecursive: (bind mount) . . o relabel: shared, private. ( SELinux) . shared private . o z, Z: relabel=shared relabel=private . o idmap: idmapped . idmap (rootful) . idmapped . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10. . . # . '@' . . o U, chown: true false ( : false). UID GID . o no-dereference: (symlinks) . type=tmpfs ramfs: o ro, readonly: true false ( : false). o tmpfs-size: tmpfs/ramfs . . o tmpfs-mode: (octal file mode) tmpfs/ramfs ( 700 0700). o tmpcopyup: (copyup) tmpfs/ramfs. . tmpfs (bind mount) tmpfs . notmpcopyup tmpfs (shadow ). o noatime: . o notmpcopyup: tmpfs/ramfs . tmpfs bind mount tmpfs ( ). o U, chown: true false ( : false). uid gid tmpfs UID GID . . type=devpts: o uid: UID (: 0). o gid: GID (: 0). o mode: (: 600). o max: PTY (: 1048576). Examples: o type=bind,source=/path/on/host,destination=/path/in/container o type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared o type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true o type=bind,src=/path/on/host,dst=/path/in/container,idmap o type=bind,src=/path/on/host,dst=/path/in/container,idmap=uids=0-1-10;gids=0-100-10 o type=devpts,destination=/dev/pts o type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true o type=image,source=fedora,destination=/fedora-image,rw=true o type=ramfs,tmpfs-size=512M,destination=/path/in/container o type=tmpfs,tmpfs-size=512M,destination=/path/in/container o type=tmpfs,destination=/path/in/container,noswap o type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data o type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1 o type=volume,destination=/path/in/container o type=volume,src=test_vol,dst=/data,subpath=/code/docs Network=mode . : o name .network systemd-$name systemd $name-network.service . $name.network . : .network . o name .container $name.container . systemd $name.service . : .container . mode : o bridge[:OPTIONS,...]: (bridge) . (rootful) . : o alias=name: . o ip=IPv4: IPv4 . o ip6=IPv6: IPv6 . o mac=MAC: MAC . o interface_name=name: . o host_interface_name=name: . netavark . netavark . bridge (rootless) (port forwarding) rootlessport . rootless_port_forwarder="pasta" [network] containers.conf(5) pasta ( pesto) IP . . IPv4 mac --network bridge:ip=10.88.0.10,mac=44:33:22:11:00:99 . o [:OPTIONS,...]: podman network create . bridge . --network . --network bridge . o none: . o container:id: . o host: . : (abstract Unix domain sockets) TCP/UDP localhost . . o ns:path: . o private: . (rootful) bridge (rootless) pasta . o pasta[:OPTIONS,...]: pasta(1) (user-mode). (rootless) . IPv4 IPv6 . IP . pasta(1) . pasta(1) --config-net --no-map-gw (gateway) . --map-gw pasta ( pasta(1) ). DNS --dns-forward 169.254.1.1 resolv.conf(5) . IP --dns-forward . host.containers.internal /etc/hosts --map-guest-addr 169.254.1.2 . IP . TCP UDP ( --publish -t/-u pasta) -t none -u none . -T none -U none . containers.conf(5) pasta_options network . : o pasta:--map-gw: (gateway). o pasta:--mtu,1500: MTU 1500 tap . o pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns- forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp: IPv6 10.0.2.0/24 tap0 10.0.2.3 DNS 10.0.2.3 MTU 1500 NDP DHCPv6 DHCP. o pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns- forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp: MTU 65520 . o pasta:-t,auto,-u,auto,-T,auto,-U,auto: . o pasta:-T,5201: TCP 5201 loopback tap . NetworkAlias=alias . alias --network . DNS (podman network inspect -f {{.DNSEnabled}} ) . . NoNewPrivileges=bool (: false) setuid (file capabilities) . Notify=bool (: false) systemd . . sd_notify Notify true . Notify healthy (healthy) . HealthCmd . PidsLimit=limit PID . PID -1 . cgroup "pids" 2048 . Pod=name .pod . .pod .pod . . PodmanArgs= podman . (generator) . . . . PublishPort=[[hostIP:][hostPort]:]containerPort[/protocol] . hostPort containerPort . . hostIP 0.0.0.0 IPv4 [::] IPv6 . IP . hostIP IP v4 v6 ( ) . hostIP containers.conf(5) default_host_ips [network] . IP . default_host_ips = ["127.0.0.1", "::1"] localhost ipv4 ipv6 . hostIP . TCP . UDP udp . TCP UDP --publish tcp udp . (rootful) sctp . ( podman run -p 127.0.0.1::80). . podman port : podman port $CONTAINER $CONTAINERPORT. bridge pasta . bridge (rootless) rootlessport IP . rootless_port_forwarder="pasta" [network] containers.conf(5) pasta pesto IP . . Pull=policy (pull) . missing . o always: . o missing: . . o never: . . o newer: (registry) . (digests) . . . ReadOnly= . . ReadOnly= . ReadOnlyTmpfs=true|false --read- only tmpfs - /dev /dev/shm /run /tmp /var/tmp . true . +------------+-------------------+-----+----------------------+ |--read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp | +------------+-------------------+-----+----------------------+ |true | true | r/o | r/w | +------------+-------------------+-----+----------------------+ |true | false | r/o | r/o | +------------+-------------------+-----+----------------------+ |false | false | r/w | r/w | +------------+-------------------+-----+----------------------+ |false | true | r/w | r/w | +------------+-------------------+-----+----------------------+ ReadOnly=true ReadOnlyTmpfs=true tmpfs /tmp /run /var/tmp . ReadOnly=true ReadOnlyTmpfs=false /dev /dev/shm tmpfs /tmp /run /var/tmp . . . . . ReadOnly=false /dev /dev/shm - /tmp /run /var/tmp - . ReloadCmd=/usr/bin/command ExecReload= Service podman exec . systemctl reload . ReloadSignal . ReloadSignal=signal ExecReload= Service podman kill . systemctl reload . ReloadCmd . Retry=attempts (pull) (push) (registry) . 3 . RetryDelay=duration . . . Rootfs= (exploded container) . Image . rootfs . Overlay Rootfs Mounts :O rootfs overlay file system . . overlay (lower) (upper) . tmpfs (unmount) . : SELinux rootfs unconfined_u:object_r:container_file_t:s0 . idmap idmap idmapped . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10. . . # . RunInit= init . container-init /run/podman-init . /run . SeccompProfile=path seccomp . . JSON unconfined seccomp . Secret=secret[,opt=opt ...] (/ ) . . TLS SSH ( 512 ). mount . env . podman secret . podman secret . Secret o type=mount|env : . mount . env . mount . o target=target : . (mounted) . . /run/secrets/target /var/run/secrets/target FreeBSD . /run/secrets/secretname . env . secretname . o uid=0 : UID . 0 . mount. o gid=0 : GID . 0 . mount. o mode=0 : (mode) . 0444 . mount. /my/location/mysecret UID 1: --secret mysecret,target=/my/location/mysecret,uid=1 /run/secrets/customtarget mode 0777: --secret mysecret,target=customtarget,mode=0777 ENVSEC: --secret mysecret,type=env,target=ENVSEC SecurityLabelDisable=bool (label separation) . SecurityLabelFileType=label . SecurityLabelLevel=s0:c1,c2 . SecurityLabelNested=bool SecurityLabel . . SecurityLabelType=type . ShmSize=number[unit] /dev/shm. unit b () k () m () g () . () . 64m . size 0 IPC . --ipc=host . StartWithPod=bool . true . true // . false . . . : [Install] (target) . . StopSignal=signal . SIGTERM . StopTimeout=seconds . 10 . containers.conf . : systemd podman rm systemd (kill) . SubGIDMap=name name /etc/subgid. (rootless) . subgid(5) . UserNS= GIDMap= . GIDMap= GIDMap= name /etc/subgid . SubUIDMap=name name /etc/subuid. (rootless) . subuid(5) . UserNS= UIDMap= . UIDMap= UIDMap= name /etc/subuid . Sysctl=name=value . IPC sysctl : o kernel.msgmax o kernel.msgmnb o kernel.msgmni o kernel.sem o kernel.shmall o kernel.shmmax o kernel.shmmni o kernel.shm_rmid_forced o Sysctl fs.mqueue.* : --ipc=host sysctl . sysctl net.* . : --network=host sysctl . Timezone=timezone . GMT local . /usr/share/zoneinfo/ . containers.conf . Tmpfs= tmpfs. (tmpfs) : $ podman podman-container.unit.5.md.in -d --tmpfs /tmp:rw,size=787448k,mode=1777 my_image tmpfs /tmp . . : rw,noexec,nosuid,nodev. tmpcopyup tmpfs tmpfs . tmpfs bind mount : tmpfs . tmpfs (shadow ) notmpcopyup : $ podman podman-container.unit.5.md.in --volume myvolume:/data --tmpfs /data/sub:notmpcopyup my_image UIDMap=[flags]container_uid:from_uid[:amount] UID . UserNS= SubUIDMap= . UID UID . . flags . amount 1 . from_uid (rootful) (rootless). o (rootful): [flags]container_uid:host_uid[:amount] o (rootless): [flags]container_uid:intermediate_uid[:amount] Rootful mappings podman UIDMap= UID UID . host UID -> container UID amount UID . amount 4 : +-------------+-------------------+ |host UID | container UID | +-------------+-------------------+ |from_uid | container_uid | +-------------+-------------------+ |from_uid + 1 | container_uid + 1 | +-------------+-------------------+ |from_uid + 2 | container_uid + 2 | +-------------+-------------------+ |from_uid + 3 | container_uid + 3 | +-------------+-------------------+ Rootless mappings podman ( ) from_uid <>> . UID UID . : host UID -> intermediate UID -> container UID UIDMap= . /etc/subuid UID . : +--------------------+------------------+ |host UID | intermediate UID | +--------------------+------------------+ |UID for Podman user | 0 | +--------------------+------------------+ |1st subordinate UID | 1 | +--------------------+------------------+ |2nd subordinate UID | 2 | +--------------------+------------------+ |3rd subordinate UID | 3 | +--------------------+------------------+ |nth subordinate UID | n | +--------------------+------------------+ UID UID /etc/subuid . subuid(5) . UIDMap= . amount 5 : +-----------------+-------------------+ |intermediate UID | container UID | +-----------------+-------------------+ |from_uid | container_uid | +-----------------+-------------------+ |from_uid + 1 | container_uid + 1 | +-----------------+-------------------+ |from_uid + 2 | container_uid + 2 | +-----------------+-------------------+ |from_uid + 3 | container_uid + 3 | +-----------------+-------------------+ |from_uid + 4 | container_uid + 4 | +-----------------+-------------------+ /etc/subuid . UID=0 . : +----------------------+-------------------------+----------------------+ |host | rootless user namespace | length | +----------------------+-------------------------+----------------------+ |$UID | 0 | 1 | +----------------------+-------------------------+----------------------+ |1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +----------------------+-------------------------+----------------------+ |1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH | +----------------------+-------------------------+----------------------+ Referencing a host ID from the parent namespace UIDMap= GIDMap= . . podman unshare cat /proc/self/gid_map . @ . --gidmap 100000:@2000:1 2000 100000 . ( ). --gidmap 100000:@2000:2 2000 2001 100000 100001 . Extending previous mappings . --gidmap="0:0:65000" 1 100000 1 . --gidmap --gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1" . + . : --gidmap="0:0:65000" --gidmap="+100000:1:1" +-----+-------------+----------------------------------------------+ |Flag | Example | Description | +-----+-------------+----------------------------------------------+ |+ | +100000:1:1 | | +-----+-------------+----------------------------------------------+ : --gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1" . + --gidmap="+100000:1:1" . << >>. . Passing only one of --uidmap or --gidmap . UIDMap= GIDMap= UID GID . u g UID GID . +-----+---------------+---------------------+ |flag | Example | Description | +-----+---------------+---------------------+ |u | u20000:2000:1 | | | | | | | | | UID | | | | | | | | | +-----+---------------+---------------------+ |g | g10000:1000:1 | | | | | | | | | GID | | | | | | | | | +-----+---------------+---------------------+ : podman podman-container.unit.5.md.in --gidmap "0:0:1000" --gidmap "g2000:2000:1" UIDMap= GIDMap= UIDMap= : podman podman-container.unit.5.md.in --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" --gidmap "g2000:2000:1" g UIDMap= . Rootless mapping of additional host GIDs /etc/subgid . GIDMap="+gcontainer_gid:@host_gid" . : o GID @ . o GID g --usermap . o + 0 n GID . 2000 ( usermod --add-subgids 2000-2000 $USER) : GIDMap=+g100000:@2000. GroupAdd=keep-groups 100000 2000 100000 . podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... No subordinate UIDs UID /etc/subuid podman podman-container.unit.5.md.in --uidmap $container_uid:0:1 --user $container_uid ... UIDMap= UID UID . Pods UIDMap= Pod= uidmap . Ulimit=option Ulimit. ulimit . --ulimit (soft) (hard) =[:] . : $ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n 1024 1- . (rootful) (unlimited) . nofile nproc containers.conf(5) . . host . nproc ulimit nproc . --pids-limit cgroup . Unmask= (unmask) . unmask=ALL /path/1:/path/2 (/proc/*): ALL . (masked) : /proc/acpi /proc/kcore /proc/keys /proc/latency_stats /proc/sched_debug /proc/scsi /proc/timer_list /proc/timer_stats /sys/firmware /sys/fs/selinux. (read-only) : /proc/asound /proc/bus /proc/fs /proc/irq /proc/sys /proc/sysrq-trigger /sys/fs/cgroup. User=user[:group] UID GID . user group . . USER Containerfile root . UID GID UID GID . UID GID UID GID . root UID GID . UserNS=mode (user namespace mode) . --userns : - --pod --userns . - PODMAN_USERNS . - userns containers.conf . - --userns=host . --userns="" ( ) --userns=host . GIDMap= UIDMap= SubUIDMap= SubGIDMap= . --userns : +------------------------+-----------+--------------------------+ |Key | Host User | Container User | +------------------------+-----------+--------------------------+ |auto | $UID | nil ( UID | | | | | | | | | | | | | | | | | | | | | | | | .) | +------------------------+-----------+--------------------------+ |host | $UID | 0 ( | | | | | | | | | | | | root | | | | | | | | | | | | | | | | .) | +------------------------+-----------+--------------------------+ |keep-id | $UID | $UID ( | | | | | | | | | | | | UID | | | | | | | | .) | +------------------------+-----------+--------------------------+ |keep-id:uid=200,gid=210 | $UID | 200:210 ( | | | | | | | | | | | | | | | | | | | | UID GID | | | | | | | | .) | +------------------------+-----------+--------------------------+ |nomap | $UID | nil ( UID | | | | | | | | | | | | | | | | | | | | | | | | .) | +------------------------+-----------+--------------------------+ mode : auto[:OPTIONS,...]: . o (rootful): --userns=auto containers /etc/subuid /etc/subgid . : containers:2147483647:2147483648. o (rootless): /etc/subuid /etc/subgid . --userns=auto UID . subuid(5) . UID GID containers . UID . UID GID size . --userns=keep-id subuid subgid . --userns=nomap subuid subgid . --userns=auto --userns=nomap --userns=keep-id . auto: o gidmapping=CONTAINER_GID:HOST_GID:SIZE: GID . o size=SIZE: . : --userns=auto:size=8192. size auto . o uidmapping=CONTAINER_UID:HOST_UID:SIZE: UID . UID GID gidmapping uidmapping @ . . UIDMap= . container:id: . host "" ( ): . . keep-id: UID:GID . root . init UID . USER --user . keep-id: o uid=UID: UID . o gid=GID: GID . o size=SIZE: . . root . nomap: UID:GID . (root) . ns:namespace: . Volume=[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]] (bind mount). -v /HOST-DIR:/CONTAINER-DIR /HOST-DIR /CONTAINER-DIR . -v SOURCE-VOLUME:/CONTAINER-DIR . . nocreate . --rm podman rm --volumes . : o SOURCE-VOLUME .volume systemd-$name systemd $name-volume.service . .volume . ( Mac ( WSL2) .) OPTIONS : o rw|ro o z|Z o [O] o [U] o [no]copy o [no]dev o [no]exec o [no]suid o [r]bind o [r]shared|[r]slave|[r]private[r]unbindable [1] <#Footnote1> o idmap[=options] o nocreate CONTAINER-DIR /src/docs . . . . . . . / . . --rm podman rm --volumes . nocreate . nocreate . . $ podman podman-container.unit.5.md.in -v myvolume:/data:nocreate alpine -v . Write Protected Volume Mounts :ro :rw - . - . . Chowning Volume Mounts . chown : o ( NeedsChown true ) o (copy up) o o "image" idmapped ( idmap) idmapped UID/GID . idmapping . UID GID UID GID . :U UID GID UID GID . UID/GID . inode . Warning . Labeling Volume Mounts SELinux . . . :z :Z . . z . . / . Z . . : pod SELinux . :Z /. inode . z . chcon -Rt container_file_t PATH . : . . SELinux . --security-opt label=disable SELinux . (home) SELinux . $ podman podman-container.unit.5.md.in --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file Overlay Volume Mounts :O overlay file system . . overlay lower () upper () . tmpfs unmount . overlay upperdir workdir overlay . upperdir workdir . : :O,upperdir=/some/upper,workdir=/some/work . overlay () . : O . . SELinux . container_share_t / container_file_t /. SELinux . overlay . . Mounts propagation bind mount private . . . shared . slave[1] <#Footnote1> : . [r]shared [r]slave [r]private [r]unbindable . bind . ( ) . (shared) shared . slave shared slave. [1] <#Footnote1> rbind . bind . copy . copy . . copy bind . nosuid SUID . nosuid . noexec . nodev . nodev . HOST-DIR dev suid exec . df HOST-DIR findmnt -o TARGET,PROPAGATION source- mount-dir . findmnt(1) /proc/self/mountinfo . "optional fields" . shared:N (shared) master:N (slave) (private) . [1] <#Footnote1> mount(8) . /foo bind mount --bind /foo /foo mount --make- private --make-shared /foo . /foo (shared) . . / /foo mount --make-shared / / . : . Idmapped mount idmap (idmapped mount) . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10. . . # . WorkingDir=dir . (/) . WORKDIR . WorkingDir= . (SERVICE TYPE) Type=notify .container . Type= [Service] . ( init) : [Service] Type=oneshot RemainAfterExit=yes systemd.service(5) . (INSTALL SECTION) [Install] : [Install] WantedBy=multi-user.target Alias= WantedBy= RequiredBy= UpheldBy= . (TIMEOUTS) systemd ( ). : [Service] TimeoutStartSec=900 : TimeoutStartSec Type=oneshot . (NETWORK DEPENDENCIES) : o After=network-online.target ( ) o After=podman-user-wait-network-online.service ( ) : [Quadlet] DefaultDependencies=false (RESOURCE NAMING) systemd- . ContainerName= . systemd %N -- . (TEMPLATE UNITS) foo@.container foo@.service . : systemctl start foo@bar.service : ln -s foo@.container foo@bar.container - : foo@bar.container.d/10-override.conf - (DROP-IN FILES) - .container.d/ . -: test.container.d/10-extra.conf . - systemd . (EXAMPLE) : [Unit] Description=A minimal container [Container] Image=quay.io/centos/centos:latest Exec=sleep 60 [Install] WantedBy=multi-user.target (SEE ALSO) podman-run(1), podman-systemd.unit(5), systemd.service(5), systemd.unit(5) podman-container.unit(5)