podman-create(1) General Commands Manual podman-create(1) (NAME) podman-create - (SYNOPSIS) podman create [] [ [...]] (DESCRIPTION) . (ID) . podman run -d . podman start . (OPTIONS) --add-host=hostname[;hostname[;...]]:ip IP ( host=ip host:ip). /etc/hosts. hostname=ip hostname:ip . --add-host . --annotation=key=value (annotation) ( OCI) -a, --attach= STDIN STDOUT STDERR --arch=ARCH ARCH . (: arm arm64 386 amd64 ppc64le s390x) --attach, -a=stdin | stdout | stderr (stdin) (stdout) (stderr). --authfile=path . ${XDG_RUNTIME_DIR}/containers/auth.json . containers-auth.json(5) . podman login . $HOME/.podman/config.json podman login . : REGISTRY_AUTH_FILE . export REGISTRY_AUTH_FILE=path --blkio-weight=weight / ( ) 10 1000 0 ( 0) --blkio-weight-device=device:weight / ( ) --cap-add=capability (Linux capabilities) --cap-drop=capability (Linux capabilities) --cert-dir=path path (*.crt *.cert *.key) . /etc/containers/certs.d . --cgroup-conf=KEY=VALUE cgroup v2 . --cgroup-parent=path (cgroup) --cgroupns=mode cgroup (host|private) 'host': cgroup 'private': cgroup '': cgroup default-cgroupns-mode () --cgroups=how (cgroup) ( enabled disabled no-conmon). --chrootdirs=path chroot . --cidfile=file --conmon-pidfile=file (PID) conmon. --cpu-period=limit CFS ( ) --cpu-quota=limit CFS ( ) --cpu-rt-period=microseconds (real- time) --cpu-rt-runtime=microseconds (real-time) -c, --cpu-shares=0 ( ) --cpu-shares, -c=shares ( ) . . 1024 --cpu-shares 2 . . . . cpu-share 1024 cpu- share 512 . %100 %50 . cpu-share 1024 %33 . %16.5 %16.5 %33 . . %100 %100 . . {C0} -c=512 {C1} -c=1024 : PID container CPU CPU share 100 {C0} 0 100% of CPU0 101 {C1} 1 100% of CPU1 102 {C1} 2 100% of CPU2 --cpus=number --cpuset-cpus=number (0-3, 0,1) --cpuset-mems=nodes (0-3, 0,1) --creds=[username[:password]] [username[:password]] . . . --decryption-key=key[:passphrase] [key[:passphrase]] . / . . (passphrase) . --device=host-device[:container-device][:permissions] --device-cgroup-rule="type major:minor mode" cgroup --device-read-bps=path:rate ( ) --device-read-iops=path:rate (/ ) --device-write-bps=path:rate ( ) --device-write-iops=path:rate (/ ) --disable-content-trust Podman . (NOOP) . --dns=ipaddr DNS --dns-option=option DNS --dns-search=domain DNS --entrypoint="command" | '["command", arg1 , ...]' ENTRYPOINT -e, --env= --env, -e=env ( env=value) . . = *value* env . env ENV Containerfile . --unsetenv . --env-file=file --env-host . --env-merge=env . --expose=port[/protocol] (expose) --gidmap=[flags]container_gid:from_gid[:amount] (GID) (rootless). --gpus=ENTRY (GPU) ('all' GPU) --group-add=group | keep-groups --group-entry=ENTRY /etc/group . --health-cmd="command" | '["command", arg1 , ...]' --health-interval=interval (ms|s|m|h) ( 0s) --health-log-destination=directory_path ( directory local none). --health-max-log-count=number of stored logs . --health-max-log-size=size of stored logs . --health-on-failure=action ( none kill restart stop). --health-retries=retries --health-start-period=period health-retries (ms|s|m|h) ( 0s) --health-startup-cmd="command" | '["command", arg1 , ...]' . --health-startup-interval=interval . --health-startup-retries=retries . --health-startup-success=retries . --health-startup-timeout=timeout . --health-timeout=timeout (ms|s|m|h) ( 0s) --help -h, --hostname="" --hostname, -h=name (hostname) . --hosts-file=path | none | image /etc/hosts . --hostuser=name . --http-proxy (proxy) Podman . --http- proxy false . http_proxy https_proxy ftp_proxy no_proxy . true . --image-volume=bind | tmpfs | ignore (bind tmpfs ignore). --init init -i, --interactive[=false] STDIN --init-ctr=type (init container) . --init-path=path init . --interactive, -i (stdin) . --ip=IPv4 IPv4 ( 172.30.100.104) --ip6=IPv6 IPv6 ( 2001:db8::33) --ipc=ipc IPC --label, -l=key=value label ( label=value) . . label = value label . LABEL io.containers.capabilities=CAP1,CAP2,CAP3 Containerfile (capabilities) . Podman . . . --label-file=file --link-local-ip=ip - (link-local) IPv4/IPv6 --log-driver=driver (log driver) --log-opt=name=value --mac-address=address MAC ( 92:d0:c6:0a:29:33) -m, --memory=0 --memory, -m=number[unit] (: [] b k m g ) . swap -m (RAM) . 0 ( -m) . ( ). --memory-reservation=number[unit] --memory-swap=number[unit] (swap) swap '-1' swap --memory-swappiness=number (swappiness) 0 100 --mount=type=TYPE,TYPE-SPECIFIC-OPTION[,...] --name=name --network=mode, --net --network-alias=alias --no-healthcheck HEALTHCHECK --no-hostname /etc/hostname RUN . Podman /etc/hostname . --no- hostname /etc/hostname ( ) . --no-hosts /etc/hosts RUN . Podman /etc/hosts IP . --no-hosts /etc/hosts . --add-host . --oom-kill-disable (OOM Killer) --oom-score-adj=num OOM ( -1000 1000) --os=OS . --passwd-entry=ENTRY /etc/passwd . --personality=persona (Linux Personality). --pid=mode PID --pidfile=path (PID) . --pids-limit=limit (pids) ( -1 ) --platform=OS/ARCH --pod=name new:. --pod-id-file=file . --privileged -p, --publish= () -P, --publish-all[=false] --publish, -p=[[hostIP:][hostPort]:]containerPort[/protocol] . --publish-all, -P . --pull=policy ("always" "missing" "never") -q, --quiet[=false] --quiet, -q . --rdt-class=intel-rdt-class-of-service (Intel RDT) . --read-only --read-only-tmpfs tmpfs /tmp /var/tmp . --replace . --requires=container . --restart=policy --retry=attempts . 3 . --retry-delay=duration . 2s . --rm --rootfs . --sdnotify=container | conmon | healthy | ignore systemd sd_notify ( container conmon ignore). --seccomp-policy=policy seccomp ( default image). --secret=secret[,opt=opt ...] ( / secret) Containerfile . "id" "src" ( ) "env" . () /run/secrets/ (mount) . --mount RUN Containerfile : RUN --mount=type=secret,id=mysecret cat /run/secrets/mysecret "target" "dst" "destination" RUN --mount . RUN --mount=type=secret,id=mysecret,target=/run/secrets/myothersecret cat /run/secrets/myothersecret : RUN --mount=type=secret,id=mysecret,env=FOO sh -c 'echo "Hello $FOO"' : . --security-opt=option --shm-size=number[unit] /dev/shm --shm-size-systemd=number[unit] /dev/shm systemd. --stop-signal=signal --stop-timeout=seconds ( ) --subgidname=name /etc/subgid . --subuidname=name /etc/subuid . --sysctl=name=value sysctl --systemd=true | false | always systemd ( true false always). --timeout=seconds . --tls-verify HTTPS ( true ). TLS . --tmpfs=fs tmpfs -t, --tty[=false] -TTY --tty, -t (pseudo-TTY) . --tz=timezone (Timezone) . --uidmap=[flags]container_uid:from_uid[:amount] (UID) . --ulimit=option ulimit --umask=umask (umask) . --unsetenv=env . --unsetenv-all . --user, -u=user[:group] (UID/GID) . --userns=mode --uts=mode UTS -v, --volume= bind mount --variant=VARIANT (variant) . --volume, -v=[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]] (bind mount). -v /HOST-DIR:/CONTAINER-DIR Podman /HOST-DIR /CONTAINER-DIR Podman . OPTIONS : o [rw|ro] o [U] o [z|Z|O] o [[r]shared|[r]slave|[r]private|[r]unbindable] [1] <#Footnote1> CONTAINER-DIR /src/docs . HOST- DIR . Podman HOST-DIR bind-mount . /foo Podman /foo bind-mount . -v . (Write Protected Volume Mounts) :ro :rw - . - . . (Chowning Volume Mounts) Podman . (user namespace) UID GID UID GID . :U Podman UID GID UID GID . (Labeling Volume Mounts) SELinux . . Podman . :z :Z . Podman . z Podman . Podman . / . Z Podman . . (Overlay Volume Mounts) :O Podman Overlay . RUN . Overlay lower upper . RUN tmpfs. RUN RUN . overlay (package cache) . : o O Z z . . SELinux . SELinux . o overlay . . bind-mount private . . . shared . slave . :[r]shared :[r]slave [r]private [r]unbindable . bind-mount . ( ) . shared shared . slave shared slave . [1] <#Footnote1> df findmnt -o TARGET,PROPAGATION findmnt mount /proc/self/mountinfo . optional fields . shared:X shared master:X slave private . [1] <#Footnote1> mount . bind-mount /foo mount --bind /foo /foo mount --make-private --make-shared /foo . /foo shared . . / /foo mount --make-shared / / shared . (EXAMPLE) podman from --pull imagename podman from --pull podman://myregistry.example.com/imagename podman from podman-daemon:imagename:imagetag podman from --name mycontainer podman-archive:filename podman from oci-archive:filename podman from --name mycontainer dir:directoryname podman from --pull-always --name "mycontainer" myregistry.example.com/imagename podman from --tls-verify=false myregistry/myrepository/imagename:imagetag podman from --creds=myusername:mypassword --cert-dir ~/auth myregistry/myrepository/imagename:imagetag podman from --authfile=/tmp/auths/myauths.json myregistry/myrepository/imagename:imagetag podman from --memory 40m --cpu-shares 2 --cpuset-cpus 0,2 --security- opt label=level:s0:c100,c200 myregistry/myrepository/imagename:imagetag podman from --ulimit nofile=1024:1028 --cgroup-parent /path/to/cgroup/parent myregistry/myrepository/imagename:imagetag podman from --volume /home/test:/myvol:ro,Z myregistry/myrepository/imagename:imagetag podman from -v /home/test:/myvol:z,U myregistry/myrepository/imagename:imagetag podman from -v /var/lib/yum:/var/lib/yum:O myregistry/myrepository/imagename:imagetag podman from --arch=arm --variant v7 myregistry/myrepository/imagename:imagetag (ENVIRONMENT) BUILD_REGISTRY_SOURCES BUILD_REGISTRY_SOURCES JSON insecureRegistries blockedRegistries allowedRegistries . (pull) blockedRegistries . allowedRegistries . TMPDIR TMPDIR (pull push) . '/var/tmp' . (FILES) registries.conf (/etc/containers/registries.conf) registries.conf . policy.json (/etc/containers/policy.json) . . . (SEE ALSO) podman(1), podman-pull(1), podman-login(1), podman-login(1), namespaces(7), pid_namespaces(7), containers-policy.json(5), containers-registries.conf(5), user_namespaces(7), containers.conf(5), containers-auth.json(5) (FOOTNOTES) : Podman . (mount propagation) master slave . . Podman . --volumes-from=CONTAINER[:OPTIONS] () -w, --workdir="" (SEE ALSO) podman(1) --workdir, -w=dir . (EXAMPLES) fedora: $ podman create -it fedora bash 6d353a48c72447cc7d0799e8334460598a3c8e9b81561726ca21c385b0d0e653 : $ podman create --name my-container fedora (EXIT STATUS) . . (SEE ALSO) podman(1), podman-run(1), podman-start(1) (HISTORY) Urvashi Mohnani . podman-create(1)