podman-run(1) General Commands Manual podman-run(1) (NAME) podman-run - (SYNOPSIS) podman run [] [ [ ...]] podman container run [] [ [ ...]] (DESCRIPTION) . podman run . podman run . podman run . podman run podman pull (pull) . . /etc/hosts /etc/hostname /etc/resolv.conf . ( --dns DNS resolv.conf ). . /run/.containerenv ( FreeBSD /var/run/.containerenv) . --privileged .containerenv / (rootless) . : /run /run/.containerenv . /etc/netns/NSNAME/resolv.conf /etc/resolv.conf . containers.conf . containers.conf . (IMAGE) transport:path . (transport) docker ( ) . () ( WSL2) docker . dir:path path tarball . . $ podman save --format docker-dir fedora -o /tmp/fedora $ podman run dir:/tmp/fedora echo hello docker://docker-reference () . : "quay.io/podman/stable:latest". registries.conf . podman login ( $XDG_RUNTIME_DIR/containers/auth.json ) $HOME/.docker/config.json . $ podman run registry.fedoraproject.org/fedora:latest echo hello docker-archive:path[:docker-reference] docker save. docker-reference (digest) . $ podman save --format docker-archive fedora -o /tmp/fedora $ podman run docker-archive:/tmp/fedora echo hello : ( WSL2) . docker-daemon:docker-reference docker-reference . docker- reference (docker-daemon:algo:digest). $ sudo docker pull fedora $ sudo podman run docker-daemon:docker.io/library/fedora echo hello : ( WSL2) . oci-archive:path:tag "Open Container Image Layout Specification" path tag. $ podman save --format oci-archive fedora -o /tmp/fedora $ podman run oci-archive:/tmp/fedora echo hello : ( WSL2) . (OPTIONS) --add-host=hostname[;hostname[;...]]:ip IP /etc/hosts . IPv4 IPv6 . IP /etc/hosts ( --name --hostname ). /etc/hosts . --no-hosts no_hosts=true containers.conf . IP host-gateway . IP . IP host-gateway . IP host_containers_internal_ip containers.conf . host-gateway host.containers.internal host.docker.internal /etc/hosts . --no-hosts host_containers_internal_ip="none" containers.conf . host-gateway IP /etc/hosts . podman machine ( ) /etc/hosts IP DNS gvproxy . /etc/hosts /etc/hosts . base_hosts_file containers.conf . --annotation=key=value (annotation) . . --arch=ARCH ( ). arm. . --attach, -a=stdin | stdout | stderr STDIN STDOUT STDERR. ( -d ) podman run . TTY ( ) . -a stdin stdout stderr . --authfile=path . ${XDG_RUNTIME_DIR}/containers/auth.json / $HOME/.config/containers/auth.json . podman login . $HOME/.docker/config.json docker login . : REGISTRY_AUTH_FILE . export REGISTRY_AUTH_FILE=path . --blkio-weight=weight Block IO. weight 10 1000 . cgroups V1 . --blkio-weight-device=device:weight Block IO. --cap-add=capability (Linux capabilities). . CAP_SYS_ADMIN CAP_SYS_PTRACE CAP_MKNOD CAP_SYS_MODULE . user_namespaces(7) . . capabilities(7) . --cap-drop=capability all . . --cert-dir=path path (*.crt, *.cert, *.key) (: etc/containers/certs.d/). containers-certs.d(5) . ( ( WSL2) ) --cgroup-conf=KEY=VALUE cgroup v2 cgroup . --cgroup-conf=memory.high=1073741824 memory.high 1GB . --cgroup-parent=path cgroups cgroup . cgroups init . Cgroups . --cgroupns=mode cgroup . o host: cgroup . o container:id: . o private: cgroup . o ns:path: . cgroups v1 host . cgroups v2 private . --cgroups=how cgroups . enabled . enabled cgroup cgroup- parent . disabled cgroups cgroup (--cgroupns --cgroup-parent) . no-conmon cgroup conmon . split cgroup : conmon . split --cgroup-parent . --chrootdirs=path chroot . ( etc/resolv.conf/ /etc/hosts /etc/hostname) root . . --cidfile=file file. podman --remote run (detached) . --conmon-pidfile=file pid conmon . conmon systemd . ( ( WSL2) ) --cpu-period=limit CPU (CFS) . CPU . 100000 . . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --cpu-quota=limit (CFS) . . CPU . . CPU ( --cpu-period) . . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --cpu-rt-period=microseconds (Real- Time) . . . (rootful) cgroups V1 . --cpu-rt-runtime=microseconds (Real-Time) . . CPU . : 1,000,000us 950,000us 95% 5% . cgroup . cgroups V1 . --cpu-shares, -c=shares ( ). CPU . . 1024 . . CPU . CPU . cpu-share 1024 cpu-share 512 . 100% 50% CPU . cpu-share 1024 33% CPU . 16.5% 16.5% 33% CPU . CPU . 100% 100% . . C0 --cpu-shares=512 C1 --cpu- shares=1024 CPU : +----+-----------+-----+--------------+ |PID | container | CPU | CPU share | +----+-----------+-----+--------------+ |100 | C0 | 0 | 100% of CPU0 | +----+-----------+-----+--------------+ |101 | C1 | 1 | 100% of CPU1 | +----+-----------+-----+--------------+ |102 | C1 | 2 | 100% of CPU2 | +----+-----------+-----+--------------+ . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --cpus=number . 0.0 . --cpu-period --cpu-quota --cpu-period --cpu-quota . CPU . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --cpuset-cpus=number . ( 0,1) ( 0-3) ( 0-3,7,11-15) . . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --cpuset-mems=nodes (MEMs) (0-3 0,1). NUMA . (0-3) --cpuset-mems=0,1 . . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --creds=[username[:password]] [[:]] . . (echo) . . (mirrors) ( containers- registries.conf(5) ) containers-auth.json(5) . --decryption-key=key[:passphrase] [key[:passphrase]] . / . . . --detach, -d (Detached): . false . podman ps . podman attach . tty ( ). ctrl-p,ctrl-q . --detach-keys containers.conf containers.conf(5) . --detach-keys=sequence . [a-Z] ctrl- : a-z @ ^ [ , _. "" . ctrl-p,ctrl-q . containers.conf(5) . --device=host-device[:container-device][:permissions] . HOST- DEVICE[:CONTAINER-DEVICE][:PERMISSIONS] HOST-DEVICE CONTAINER-DEVICE PERMISSIONS 'r' 'w' 'm' mknod(2) . : --device=/dev/sdc:/dev/xvdc:rwm. : host-device . . . : dev/fuse/. (rootless) bind mount . bind mount SELinux SELinux . SELinux : $ sudo setsebool -P container_use_devices=true : . --group-add keep-groups . --device-cgroup-rule="type major:minor mode" cgroup. admin-guide/cgroup-v1/devices : - type: a () c () b () - major minor: * - mode: r () w () m (mknod(2)). --device-read-bps=path:rate ( ) ( --device-read-bps=/dev/sda:1mb). . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --device-read-iops=path:rate ( IO ) ( --device-read-iops=/dev/sda:1000). . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --device-write-bps=path:rate ( ) ( --device-write-bps=/dev/sda:1mb). . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --device-write-iops=path:rate ( IO ) ( --device-write- iops=/dev/sda:1000). . : https://github.com/containers/podman/blob/main/troubleshooting.md#26-running- containers-with-resource-limits-fails-with-a-permissions-error cgroups V1 . --disable-content-trust . (NOOP) . --dns=ipaddr DNS . DNS . DNS ( 127.0.0.1) . --dns . none /etc/resolv.conf . /etc/resolv.conf . ipaddr /etc/resolv.conf . dns_enabled true --network /etc/resolv.conf aardvark-dns . aardvark-dns ipaddr . --network none container:id . --dns-option=option DNS. --dns-option --network none container:id . --dns-search=domain DNS. --dns-search --network none container:id . --dns-search=. . --entrypoint="command" | '["command", arg1 , ...]' ENTRYPOINT . (ENTRYPOINT) COMMAND () . ENTRYPOINT . ENTRYPOINT . COMMAND . --entrypoint= ENTRYPOINT . JSON . --env, -e=env . . . * . . --env-file=file . . --env-host . . ( ( WSL2) ) --env-merge=env . hello=world --env-merge hello=${hello}-some hello=world-some . hello --env-merge hello=${hello}-some hello=-some ( - ). --expose=port[/protocol] ( --expose=3300-3310). tcp udp sctp tcp . EXPOSE -P/--publish-all . -p/--publish . --gidmap=[flags]container_gid:from_gid[:amount] GID . --userns --subgidname . GID GID UID UID --uidmap. --uidmap . : --gidmap --pod gidmap . --gpus=ENTRY GPU. ENTRY all GPU . NVIDIA AMD . NVIDIA AMD NVIDIA CDI --device GPU . --group-add=group | keep-groups . o keep-groups . . OCI . OCI crun . : keep-groups . ( ( WSL2) ) --group-entry=ENTRY /etc/group --user. $GROUPNAME $GID $USERLIST . --health-cmd="command" | '["command", arg1 , ...]' . . . none . JSON /bin/sh -c . : . --health-interval=interval . disable . 30s . : . --health-log-destination=directory_path HealthCheck. local events_logger ( local ) (: local). o local: () ( : $runroot/healthcheck.log). o directory: -healthcheck.log . o events_logger: events_logger . . --health-max-log-count=number of stored logs ( '0' ) (: 5 ). --health-max-log-size=size of stored logs ( "0" ) (: 500 ). --health-on-failure=action . none . o none: . o kill: (kill) . o restart: . restart --restart . systemd kill stop systemd . o stop: (stop) . --health-retries=retries . 3 . : . --health-start-period=period . 2m3s . 0s . : healthy . --health-start- period starting . --health-start-period unhealthy . --health-interval . : . --health-startup-cmd="command" | '["command", arg1 , ...]' (startup) . . . . . ( --health-cmd) . --health-startup-interval=interval . disable . 30s . --health-startup-retries=retries . 0 . 0 . --health-startup-success=retries . 0 . 0 . --health-startup-timeout=timeout . 2m3s . 30s . --health-timeout=timeout . start-period 1m22s . 30s . : . timeout SIGKILL . : . --help . --hostname, -h=name (hostname) . UTS --uts=private () . --pod UTS () . IP /etc/hosts ( --add-host ). --hostname UTS () . --name container_name_as_hostname=true containers.conf . DNS ( ) --hostname DNS . . podman-network(1) . --hosts-file=path | none | image /etc/hosts . : "" base_hosts_file containers.conf () none ( ) image /etc/hosts --hostuser=name etc/passwd/ . UID . --http-proxy . false . http_proxy https_proxy ftp_proxy no_proxy . . . ( --env .) . true . --image-volume=bind | tmpfs | ignore . bind . o bind: . o tmpfs: tmpfs . o ignore: . --init init (reap) . container-init /run/podman-init . /run . --init-path=path container-init. --interactive, -i true stdin . false stdin . (attached) (stdin) . (detached) stdin (block) . : stdin . --ip=IPv4 IPv4 10.88.64.128. -- --network=network-name -- --network=container:id . IP ( 10.88.0.0/16). IP --network ip : --network mynet:ip=10.88.0.10,ip=10.88.0.11,ip=10.88.0.12 IPv4 . : IP . IP IP IP . IP: IP ( --subnet) . IP . : podman network create --subnet 10.89.0.0/24 --subnet 10.90.0.0/24 mynet podman run --network mynet:ip=10.90.0.20,ip=10.89.0.10,ip=10.89.0.11 alpine IP : 10.89.0.10 () 10.89.0.11 () 10.90.0.20 () 10.89.0.0/24 . : IP IP . IP IP . : podman network create --subnet 10.89.0.0/24 --subnet 10.90.0.0/24 mynet podman run --network mynet:ip=10.89.0.10,ip=10.90.0.20 alpine eth0 10.89.0.10 () 10.90.0.20 () . --ip6=IPv6 IPv6 fd46:db93:aa76:ac37::10. -- --network=network-name -- --network=container:id . IPv6 . IPv6 --network IPv6 ip6 . --ipc=ipc IPC . IPC . o "": containers.conf. o container:id: . o host: . : host . o none: IPC dev/shm/. o ns:path: IPC . o private: IPC . o shareable: IPC . --label, -l=key=value (metadata) . --label-file=file . --link-local-ip=ip . --log-driver=driver . k8s-file journald none passthrough passthrough-tty json-file k8s-file ( journald). podman info : $ podman info --format '{{ .Host.LogDriver }}' journald passthrough (stdin, stdout, stderr) . ( WSL2) tty TIOCSTI . passthrough-tty passthrough TTY . --log-opt=name=value . . : path: ( --log-opt path=/var/log/container/mycontainer.json) max-size: ( --log-opt max-size=10mb) tag: ( --log-opt tag="{{.ImageName}}". podman inspect --format . journald .) label: ( --log-opt label="CONTAINER_IMAGE={{.ImageName}}". podman inspect --format . . journald .) --mac-address=address MAC ( 92:d0:c6:0a:29:33). -- --network=network-name -- --network=container:id . MAC . link-local IPv6 MAC RFC4862 . MAC --network MAC mac . --memory, -m=number[unit] . unit b () k () m () g () . . swap --memory RAM . 0 ( --memory) . . cgroups V1 . --memory-reservation=number[unit] (soft limit). unit b () k () m () g () . . --memory . . cgroups V1 . --memory-swap=number[unit] (swap). unit b () k () m () g () . -m (--memory) . -m (--memory) . --memory . number -1 swap . cgroups V1 . --memory-swappiness=number swappiness . 0 100 . cgroups V1 . --mount=type=TYPE,TYPE-SPECIFIC-OPTION[,...] . TYPE artifact bind devpts glob image ramfs tmpfs volume. : o src, source: bind glob volume. artifact bind glob image . volume . o dst, dest, destination, target: . glob . glob . type=glob,src=/foo*,destination=/tmp/bar /foo* /tmp/bar/ . type=artifact: o digest: blob blob . o title: blob org.opencontainers.image.title . o name: . blob dst . blob -x x 0 . src . dst blob ( org.opencontainers.image.title) . . blob . dst blob . blob digest title . dst blob . blob blob dst . type=volume: o ro, readonly: true false ( : false). o U, chown: true false ( : false). UID GID . o subpath: . o relabel: shared private. ( SELinux) . shared private . o z, Z: relabel=shared relabel=private. o idmap: (idmapped) . idmap rootful . . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10 . . . # . '@' . . type=image: o rw, readwrite: true false ( : false). o subpath: . bind glob: o ro, readonly: true false ( : false). o bind-propagation: shared slave private unbindable rshared rslave runbindable rprivate ().[1] <#Footnote1> mount(2) . o bind-nonrecursive: bind mount . . o relabel: shared private. ( SELinux) . shared private . o z, Z: relabel=shared relabel=private. o idmap: (idmapped) . idmap rootful . . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10 . . . # . '@' . . o U, chown: true false ( : false). UID GID . o no-dereference: symlink . type=tmpfs ramfs: o ro, readonly: true false ( : false). o tmpfs-size: tmpfs/ramfs . . o tmpfs-mode: (octal) tmpfs/ramfs ( 700 0700). o tmpcopyup: copyup tmpfs/ramfs. . tmpfs bind mount tmpfs . notmpcopyup tmpfs . o noatime: . o notmpcopyup: tmpfs/ramfs. tmpfs bind mount tmpfs . o U, chown: true false ( : false). uid gid tmpfs UID GID . . type=devpts: o uid: UID (: 0). o gid: GID (: 0). o mode: (: 600). o max: PTY (: 1048576). : o type=bind,source=/path/on/host,destination=/path/in/container o type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared o type=bind,src=/path/on/host,dst=/path/in/container,relabel=shared,U=true o type=bind,src=/path/on/host,dst=/path/in/container,idmap o type=bind,src=/path/on/host,dst=/path/in/container,idmap=uids=0-1-10;gids=0-100-10 o type=devpts,destination=/dev/pts o type=glob,src=/usr/lib/libfoo*,destination=/usr/lib,ro=true o type=image,source=fedora,destination=/fedora-image,rw=true o type=ramfs,tmpfs-size=512M,destination=/path/in/container o type=tmpfs,tmpfs-size=512M,destination=/path/in/container o type=tmpfs,destination=/path/in/container,noswap o type=artifact,src=quay.io/libpod/testartifact:20250206-single,dst=/data o type=artifact,src=quay.io/libpod/testartifact:20250206-multi,dst=/data,title=test1 o type=volume,destination=/path/in/container o type=volume,src=test_vol,dst=/data,subpath=/code/docs --name=name --name=name . : o UUID ( "f78375b1c487e03c9438c729345e54db9d20cfa2ac1fc3494b6eb60872e74778") o UUID ( "f78375b1c487") o ( "jonah"). UUID --name exciting_chebyshev (_ ) . . . DNS exciting_chebyshev. . . IP /etc/hosts ( --add-host ). --hostname . DNS podman-network(1) . --network=mode, --net . mode : o bridge[:OPTIONS,...]: . rootful . : o alias=name: . o ip=IPv4: IPv4 . o ip6=IPv6: IPv6 . o mac=MAC: MAC . o interface_name=name: . o host_interface_name=name: . netavark netavark . rootlessport . rootless_port_forwarder="pasta" [network] containers.conf(5) pasta ( pesto) IP . . IPv4 MAC --network bridge:ip=10.88.0.10,mac=44:33:22:11:00:99 . o [:OPTIONS,...]: podman network create . bridge . --network . --network bridge . o none: . o container:id: . o host: . : TCP/UDP localhost . o ns:path: . o private: . bridge rootful pasta rootless . o pasta[:OPTIONS,...]: pasta(1) (user-mode). . IPv4 IPv6 . IP . pasta(1) . pasta(1) --config-net --no-map-gw . --map-gw pasta . DNS --dns-forward 169.254.1.1 resolv.conf(5) . IP --dns-forward . host.containers.internal /etc/hosts --map-guest-addr 169.254.1.2 . TCP UDP -t none -u none . -T none -U none . containers.conf(5) pasta_options network . : o pasta:--map-gw: . o pasta:--mtu,1500: MTU tap . o pasta:--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns- forward,10.0.2.3,-m,1500,--no-ndp,--no-dhcpv6,--no-dhcp: IPv6 10.0.2.0/24 tap0 10.0.2.3 DNS 10.0.2.3 MTU NDP DHCPv6 DHCP. o pasta:-I,tap0,--ipv4-only,-a,10.0.2.0,-n,24,-g,10.0.2.2,--dns- forward,10.0.2.3,--no-ndp,--no-dhcpv6,--no-dhcp: MTU . o pasta:-t,auto,-u,auto,-T,auto,-U,auto: . o pasta:-T,5201: TCP loopback tap . --dns --dns-option --dns-search --network none container:id . --pod . --network-alias=alias . alias --network . DNS (podman network inspect -f {{.DNSEnabled}} ) . . --no-healthcheck . --no-hostname /etc/hostname . /etc/hostname . --no-hostname /etc/hostname . --no-hosts /etc/hosts . /etc/hosts ( --name) ( --hostname) host.containers.internal host.docker.internal --add-host . --add-host . --no-hosts /etc/hosts . no_hosts=true containers.conf . --add-host . --oom-kill-disable OOM Killer . cgroups V2 . --oom-score-adj=num OOM ( -1000 1000 ). oom_score_adj . oom-score-adj . --os=OS ( ). windows. . --passwd etc/passwd/ etc/group/ --user. libnss-extrausers . --passwd-entry=ENTRY /etc/passwd --passwd. $USERNAME $UID $GID $NAME $HOME . --personality=persona personality(2) . --pid=mode PID . PID . o container:id: PID o host: PID . host PID o ns:path: PID o private: (). --pidfile=path pidfile PID . ( ( WSL2) ). pidfile PID /run/containers/storage/${storage- driver}-containers/$CID/userdata/pidfile . pidfile podman inspect : $ podman inspect --format '{{ .PidFile }}' $CID /run/containers/storage/${storage-driver}-containers/$CID/userdata/pidfile --pids-limit=limit (pids) . -1 . cgroup "pids" 2048 . --platform=OS/ARCH ( arch-- os-- ). --platform . . --pod=name . new: . podman pod create . infra-container infra-container . --pod-id-file=file file . infra-container infra- container . --preserve-fd=FD1[,FD2,...] . . OCI crun . OCI . ( ( WSL2) ) --preserve-fds=N N ( 0 1 2). 3+N . ( ( WSL2) ) --privileged . false . (=false) . . " " (/dev/tty\d+) systemd (--systemd=always). . Apparmor/SELinux Seccomp . privileged . ( rootless) . --publish, -p=[[hostIP:][hostPort]:]containerPort[/protocol] () . hostPort containerPort . . hostIP 0.0.0.0 IPv4 [::] IPv6 . IP . hostIP IP v4 v6 ( ) . hostIP containers.conf(5) default_host_ips [network] . IP . default_host_ips = ["127.0.0.1", "::1"] ipv4 ipv6 . hostIP . TCP . UDP udp . TCP UDP --publish tcp udp . (Rootful) sctp . ( podman run -p 127.0.0.1::80). . podman port : podman port $CONTAINER $CONTAINERPORT. bridge pasta . bridge rootlessport IP . rootless_port_forwarder="pasta" [network] containers.conf(5) pasta pesto IP . . : . . -- IP . . localhost localhost . --publish-all, -P . false . true . -P ( -p) . (ephemeral) /proc/sys/net/ipv4/ip_local_port_range . podman port . --pull=policy (Pull) . missing . o always: . o missing: . . o never: . . o newer: . . . . --quiet, -q . --rdt-class=intel-rdt-class-of-service (CLOS COS) . (CAT) (RDT) COS . COS ( /sys/fs/resctrl ) resctrl . COS . runc . COS . --read-only . . --read-only . --read-only-tmpfs --read-only tmpfs - /dev /dev/shm /run /tmp /var/tmp . true . +------------+-------------------+-----+----------------------+ |--read-only | --read-only-tmpfs | / | /run, /tmp, /var/tmp | +------------+-------------------+-----+----------------------+ |true | true | r/o | r/w | +------------+-------------------+-----+----------------------+ |true | false | r/o | r/o | +------------+-------------------+-----+----------------------+ |false | false | r/w | r/w | +------------+-------------------+-----+----------------------+ |false | true | r/w | r/w | +------------+-------------------+-----+----------------------+ --read-only=true --read-only-tmpfs=true tmpfs /tmp /run /var/tmp . --read-only=true --read-only-tmpfs=false /dev /dev/shm tmpfs /tmp /run /var/tmp . . . . (volumes) . --read-only=false /dev /dev/shm / /tmp /run /var/tmp / . --replace . false . --requires=container . . . --restart=policy . podman kill podman stop . policy : o no : o never : no o on-failure[:max_retries] : max_retries o always : o unless-stopped : . podman- restart.service . always systemd podman-restart.service . systemd restart systemd . Restart= [Service] . podman-systemd.unit(5) systemd.service(5) . --retry=attempts . 3 . --retry-delay=duration . . . --rm (unnamed) . false . --rmi . --rm . false . --rootfs . (rootfs) . Overlay Rootfs :O rootfs overlay . . overlay lower upper . tmpfs . : SELinux unconfined_u:object_r:container_file_t:s0 . idmap idmap (idmapped mount) . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10. . . # . --sdnotify=container | conmon | healthy | ignore NOTIFY_SOCKET systemd Type=notify . container OCI . MAINPID pid conmon . conmon MAINPID pid conmon READY . . healthy MAINPID pid conmon READY (healthcheck) . . ignore NOTIFY_SOCKET NOTIFY_SOCKET . --seccomp-policy=policy seccomp . image "io.containers.seccomp.profile" seccomp . default --security-opt seccomp . . --secret=secret[,opt=opt ...] ( ). . TLS SSH ( ). mount . env . podman secret . podman secret . o type=mount|env : . mount . env . mount . o target=target : . . . /run/secrets/target /var/run/secrets/target FreeBSD . /run/secrets/secretname . (env) . secretname . o uid=0 : (UID) . 0 . mount. o gid=0 : (GID) . 0 . mount. o mode=0 : (Mode) . 0444 . mount. /my/location/mysecret UID 1: --secret mysecret,target=/my/location/mysecret,uid=1 /run/secrets/customtarget 0777: --secret mysecret,target=customtarget,mode=0777 ENVSEC: --secret mysecret,type=env,target=ENVSEC --security-opt=option o apparmor=unconfined : apparmor o apparmor=alternate-profile : apparmor o label=user:USER: o label=role:ROLE: o label=type:TYPE: o label=level:LEVEL: o label=filetype:TYPE: o label=disable: : label=false containers.conf (/etc/containers/containers.conf $HOME/.config/containers/containers.conf) . o label=nested: SELinux . SELinux SELinux . nested SELinux . o mask=/path/1:/path/2: . . o no-new-privileges: execve(2) ( setuid setgid ). setuid/setgid ( setcap) . : https://docs.kernel.org/userspace- api/no_new_privs.html . o seccomp=unconfined: seccomp . o seccomp=profile.json: JSON seccomp. io.podman.annotations.seccomp podman inspect . o proc-opts=OPTIONS : /proc. proc(5) . o unmask=ALL /path/1:/path/2 (/proc/*): . ALL . /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux, /sys/devices/virtual/powercap. /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup. : label=false containers.conf(5) . --shm-size=number[unit] /dev/shm. unit b () k () m () g () . . 64m . size 0 IPC . --ipc=host . --shm-size-systemd=number[unit] tmpfs systemd /run /run/lock /var/log/journal /tmp. unit b () k () m () g () . . 64m . size 0 . --sig-proxy . SIGCHLD SIGURG SIGSTOP SIGKILL . true . --stop-signal=signal . SIGTERM . --stop-timeout=seconds () . 10 . containers.conf . --subgidname=name name /etc/subgid. (rootless) . subgid(5) . --userns --gidmap . --gidmap --gidmap name /etc/subgid . --subuidname=name name /etc/subuid. (rootless) . subuid(5) . --userns --uidmap . --uidmap --uidmap name /etc/subuid . --sysctl=name=value . IPC sysctl : o kernel.msgmax o kernel.msgmnb o kernel.msgmni o kernel.sem o kernel.shmall o kernel.shmmax o kernel.shmmni o kernel.shm_rmid_forced o sysctl fs.mqueue.* : --ipc=host sysctl . sysctl net.* . : --network=host sysctl . --systemd=true | false | always systemd. true . o true systemd systemd /usr/sbin/init /sbin/init /usr/local/sbin/init . o false systemd . o always systemd . systemd : o tmpfs o /run o /run/lock o /tmp o /sys/fs/cgroup/systemd ( cgroup v1) o /var/lib/journal o SIGRTMIN+3 . o container_uuid . o --privileged (/dev/tty\d+) . o cgroup v2 /sys/fs/cgroup . systemd . SELinux cgroup . cgroup . container_manage_cgroup SELinux . setsebool -P container_manage_cgroup true --timeout=seconds conmon kill . podman stop . --tls-verify HTTPS (: true). true TLS . false TLS . TLS containers-registries.conf(5) . --tmpfs=fs tmpfs. (tmpfs) : $ podman run -d --tmpfs /tmp:rw,size=787448k,mode=1777 my_image tmpfs /tmp . . : rw,noexec,nosuid,nodev. tmpcopyup tmpfs tmpfs . tmpfs : tmpfs . tmpfs (shadow) notmpcopyup : $ podman run --volume myvolume:/data --tmpfs /data/sub:notmpcopyup my_image --tty, -t (pseudo-TTY). false . true pseudo-tty . . : --tty (redirection) . STDOUT STDERR . . -i -it. echo "asdf" | podman run --rm -i someimage /bin/cat --tz=timezone () . GMT local . /usr/share/zoneinfo/ . containers.conf . --uidmap=[flags]container_uid:from_uid[:amount] UID . --userns --subuidname . UID UID . . flags . amount 1 . from_uid . o (rootful): [flags]container_uid:host_uid[:amount] o (rootless): [flags]container_uid:intermediate_uid[:amount] (Rootful) podman run --uidmap UID UID . UID -> UID amount UID . amount 4 : +-------------+-------------------+ |host UID | container UID | +-------------+-------------------+ |from_uid | container_uid | +-------------+-------------------+ |from_uid + 1 | container_uid + 1 | +-------------+-------------------+ |from_uid + 2 | container_uid + 2 | +-------------+-------------------+ |from_uid + 3 | container_uid + 3 | +-------------+-------------------+ (Rootless) podman run ( ) from_uid "UID " (intermediate UID) . UID UID . : UID -> UID -> UID --uidmap . /etc/subuid UID . : +--------------------+------------------+ |host UID | intermediate UID | +--------------------+------------------+ |UID for Podman user | 0 | +--------------------+------------------+ |1st subordinate UID | 1 | +--------------------+------------------+ |2nd subordinate UID | 2 | +--------------------+------------------+ |3rd subordinate UID | 3 | +--------------------+------------------+ |nth subordinate UID | n | +--------------------+------------------+ UID UID /etc/subuid . subuid(5) . --uidmap . amount 5 : +-----------------+-------------------+ |intermediate UID | container UID | +-----------------+-------------------+ |from_uid | container_uid | +-----------------+-------------------+ |from_uid + 1 | container_uid + 1 | +-----------------+-------------------+ |from_uid + 2 | container_uid + 2 | +-----------------+-------------------+ |from_uid + 3 | container_uid + 3 | +-----------------+-------------------+ |from_uid + 4 | container_uid + 4 | +-----------------+-------------------+ /etc/subuid . UID=0 . : +----------------------+-------------------------+----------------------+ |host | rootless user namespace | length | +----------------------+-------------------------+----------------------+ |$UID | 0 | 1 | +----------------------+-------------------------+----------------------+ |1 | $FIRST_RANGE_ID | $FIRST_RANGE_LENGTH | +----------------------+-------------------------+----------------------+ |1+$FIRST_RANGE_LENGTH | $SECOND_RANGE_ID | $SECOND_RANGE_LENGTH | +----------------------+-------------------------+----------------------+ --uidmap --gidmap . . podman unshare cat /proc/self/gid_map . @ . --gidmap 100000:@2000:1 2000 100000 . ( ). --gidmap 100000:@2000:2 2000 2001 100000 100001 . . --gidmap="0:0:65000" 1 100000 1 . --gidmap : --gidmap="0:0:1" --gidmap="2:2:65534" --gidmap="100000:1:1". + . : --gidmap="0:0:65000" --gidmap="+100000:1:1" +-----+-------------+----------------------------------------------+ |Flag | Example | Description | +-----+-------------+----------------------------------------------+ |+ | +100000:1:1 | | +-----+-------------+----------------------------------------------+ : --gidmap="0:0:65000" --gidmap="+100000:1:1" --gidmap="1:65001:1" . + --gidmap="+100000:1:1" . . . --uidmap --gidmap . --uidmap --gidmap UID GID . u g UID GID . +-----+---------------+--------------------+ |flag | Example | Description | +-----+---------------+--------------------+ |u | u20000:2000:1 | | | | | | | | | | | | | UID | | | | | | | | | +-----+---------------+--------------------+ |g | g10000:1000:1 | | | | | | | | | | | | | GID | | | | | | | | | +-----+---------------+--------------------+ : podman run --gidmap "0:0:1000" --gidmap "g2000:2000:1" --uidmap --gidmap --uidmap : podman run --gidmap "0:0:1000" --gidmap "2000:2000:1" --uidmap "0:0:1000" --gidmap "g2000:2000:1" g --uidmap . GID /etc/subgid . --gidmap "+gcontainer_gid:@host_gid" . : o GID @ o GID g --usermap . o 0 n GID + . 2000 ( usermod --add-subgids 2000-2000 $USER) : --gidmap=+g100000:@2000. --group- add=keep-groups 100000 2000 100000 . podman run --group-add=keep-groups --gidmap="+g100000:@2000" ... UID UID /etc/subuid podman run --uidmap $container_uid:0:1 --user $container_uid ... --uidmap UID UID . (Pods) --uidmap --pod uidmap . --ulimit=option ulimit. ulimits . --ulimit (soft) (hard) =[:]. : $ podman run --ulimit nofile=1024:1024 --rm ubi9 ulimit -n 1024 -1 . rootful . nofile nproc 1048576 containers.conf(5) . . host . nproc ulimit nproc . --pids-limit cgroup . --umask=umask umask . 0022 . containers.conf . --unsetenv=env . containers.conf . --unsetenv-all . containers.conf . --user, -u=user[:group] UID GID . user group . . USER Containerfile root . UID GID . UID GID UID GID . root UID GID . --userns=mode . --userns : - --pod --userns . - PODMAN_USERNS . - userns containers.conf . - --userns=host . --userns="" ( ) --userns=host . --gidmap --uidmap --subuidname --subgidname . --userns=Key: +------------------------+-----------+--------------------------+ |Key | Host User | Container User | +------------------------+-----------+--------------------------+ |auto | $UID | nil (UID | | | | | | | | | | | | | | | | | | | | .) | +------------------------+-----------+--------------------------+ |host | $UID | 0 ( | | | | | | | | | | | | | | | | root | | | | | | | | | | | | .) | +------------------------+-----------+--------------------------+ |keep-id | $UID | $UID ( | | | | | | | | | | | | UID | | | | | | | | .) | +------------------------+-----------+--------------------------+ |keep-id:uid=200,gid=210 | $UID | 200:210 ( | | | | | | | | | | | | UID | | | | GID | | | | | | | | | | | | .) | +------------------------+-----------+--------------------------+ |nomap | $UID | nil (UID | | | | | | | | | | | | | | | | | | | | .) | +------------------------+-----------+--------------------------+ mode : auto[:OPTIONS,...]: . o (rootful): --userns=auto containers /etc/subuid /etc/subgid . : containers:2147483647:2147483648. o (rootless): /etc/subuid /etc/subgid . --userns=auto UID . subuid(5) . UID GID containers . UID . UID GID size . --userns=keep-id subuid subgid . --userns=nomap subuid subgid . --userns=auto --userns=nomap --userns=keep-id . auto: o gidmapping=CONTAINER_GID:HOST_GID:SIZE: GID . o size=SIZE: . --userns=auto:size=8192. size auto . o uidmapping=CONTAINER_UID:HOST_UID:SIZE: UID . UID GID gidmapping uidmapping @ . . --uidmap . container:id: . host "" ( ): . . keep-id: UID:GID . root . init UID . USER --user . keep-id: o uid=UID: UID . o gid=GID: GID . o size=SIZE: . . root . nomap: UID:GID . root . ns:namespace: . --uts=mode UTS . : o host: UTS . o private: (). o ns:[path]: UTS . o container:[container]: UTS . --variant=VARIANT VARIANT . arm arm/v5 arm/v7. --volume, -v=[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]] (bind mount). -v /HOST-DIR:/CONTAINER-DIR /HOST-DIR /CONTAINER-DIR . -v SOURCE- VOLUME:/CONTAINER-DIR . . nocreate . --rm podman rm --volumes . ( ( WSL2) .) OPTIONS : o rw|ro o z|Z o [O] o [U] o [no]copy o [no]dev o [no]exec o [no]suid o [r]bind o [r]shared|[r]slave|[r]private[r]unbindable [1] <#Footnote1> o idmap[=options] o nocreate CONTAINER-DIR /src/docs . . . . . . . / . . --rm podman rm --volumes . nocreate . nocreate . . $ podman run -v myvolume:/data:nocreate alpine -v . :ro :rw - . - . . (Chowning) . chown : o ( NeedsChown true ) o (copied up) o o "image" idmapped ( idmap) idmapped UID/GID . idmapping . UID GID UID GID . :U UID GID UID GID . Chown UID/GID . inode . : . SELinux . . . :z :Z . (relabel) . z . . / . Z . . : (pod) SELinux . :Z /. inode . z . chcon -Rt container_file_t PATH . : . . SELinux . --security- opt label=disable SELinux . (home) SELinux . $ podman run --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file Overlay :O overlay . . overlay lower upper . tmpfs . overlay upperdir workdir overlay . upperdir workdir . : :O,upperdir=/some/upper,workdir=/some/work . overlay . : O . . SELinux . container_share_t / container_file_t /. SELinux . overlay . . (Mounts propagation) bind- mount private . . . shared . slave[1] <#Footnote1> : . [r]shared [r]slave [r]private [r]unbindable . . ( ) . shared . slave shared slave . [1] <#Footnote1> rbind . bind . copy . copy . . copy . nosuid SUID . nosuid . noexec . nodev . nodev . HOST-DIR dev suid exec . df HOST-DIR findmnt -o TARGET,PROPAGATION source-mount-dir . findmnt(1) /proc/self/mountinfo . " " . shared:N master:N slave . [1] <#Footnote1> mount(8) . /foo bind mount --bind /foo /foo mount --make-private --make-shared /foo . /foo . . / /foo mount --make- shared / / . : . Idmapped idmap idmapped . idmap . idmap : idmap=uids=0-1-10#10-11-10;gids=0-100-10. . . # . --group-add keep-groups . --volumes-from=CONTAINER[:OPTIONS] () . . options : o rw|ro o z . CONTAINER . --volumes-from . . (- ) . ro rw . SELinux . . . z . . z . . / . . --workdir, -w=dir . (/) . WORKDIR . -w . (EXIT STATUS) podman run . podman run chroot(1) : 125 $ podman run --foo busybox; echo $? Error: unknown flag: --foo 125 126 $ podman run busybox /etc; echo $? Error: container_linux.go:346: starting container process caused "exec: 126 127 $ podman run busybox foo; echo $? Error: container_linux.go:346: starting container process caused "exec: 127 $ podman run busybox /bin/sh -c 'exit 3'; echo $? 3 (EXAMPLES) /usr. . (volumes) . --read-only . . . tmpfs /run /tmp . $ podman run --read-only -i -t fedora /bin/bash tmpfs --read-only-tmpfs=false . $ podman run --read-only --read-only-tmpfs=false --tmpfs /run -i -t fedora /bin/bash glob $ podman run --mount type=glob,src=/usr/lib64/libnvidiaro=true -i -t fedora /bin/bash /dev/log bind mount syslog/journal . $ podman run -v /dev/log:/dev/log -i -t fedora /bin/bash : (bash)# logger "Hello from my container" journal : (bash)# exit $ journalctl -b | grep Hello . STDIN STDOUT STDERR -a (stdin, stdout, stderr) . a- (stdin, stdout, stderr) : $ podman run -a stdin -a stdout -i -t fedora /bin/bash IPC shm_server.c : https://www.cs.cf.ac.uk/Dave/C/node27.html --ipc=host: pid httpd : $ sudo ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x01128e25 0 root 600 1000 7 : $ podman run -it shm ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status --ipc=host httpd : $ podman run -it --ipc=host shm ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x01128e25 0 root 600 1000 7 --ipc=container:id: : $ podman run -it shm bash $ sudo shm/shm_server & $ sudo ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x0000162e 0 root 666 27 1 : $ podman run shm ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status --ipc=container:id : $ podman run -it --ipc=container:ed735b2264ac shm ipcs -m $ sudo ipcs -m ------ Shared Memory Segments -------- key shmid owner perms bytes nattch status 0x0000162e 0 root 666 27 1 -p . 80 httpd 8080 : $ podman run -p 8080:80 -d fedora/httpd (Mounting External Volumes) . . (orphan) podman volume prune : $ podman run -v /var/db:/data1 -i -t fedora bash $ podman run -v data:/data2 -i -t fedora bash $ podman run -v /var/cache/dnf:/var/cache/dnf:O -ti fedora dnf -y update root U . (chown) UID GID . $ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id -v ~/data:/var/lib/mysql:Z,U mariadb root --userns=keep-id UID GID UID GID . UID /. $ podman run -d -e MARIADB_ROOT_PASSWORD=root --user mysql --userns=keep-id:uid=999,gid=999 -v ~/data:/var/lib/mysql:Z mariadb --mount : $ podman run --mount type=bind,src=/var/db,target=/data1 busybox sh $ podman run --mount type=bind,src=volume-name,target=/data1 busybox sh --mount - . -v --volume . : --mount type=,src=,dst=[,options...] bind volume tmpfs artifact devpts image glob ramfs . . Bind Bind . . bind mount . : podman run --mount type=bind,src=/etc/config,dst=/app/config alpine cat /app/config/file.conf Volume Volume . . : podman volume create mydata podman run --mount type=volume,src=mydata,dst=/var/lib/data postgres Tmpfs tmpfs (RAM) . . tmpfs . : podman run --mount type=tmpfs,dst=/cache,tmpfs-size=64m alpine Artifact devpts image glob ramfs : o artifact - . o devpts - (pseudo-terminal) . o image - . o glob - glob . o ramfs - tmpfs RAM . . --mount . : bind volume tmpfs . SELinux SELinux . SELinux /var/db . "Permission Denied" avc: syslog . SELinux : $ chcon -Rt svirt_sandbox_file_t /var/db /data1 /var/db . --security-opt . MCS/MLS MLS . . podman run --security-opt label=level:s0:c100,c200 -i -t fedora bash MLS : $ podman run --security-opt label=level:TopSecret -i -t rhel7 bash --permissive : $ podman run --security-opt label=disable -i -t fedora bash . : $ podman run --security-opt label=type:svirt_apache_t -i -t centos bash SELinux svirt_apache_t . mask --security-opt . $ podman run --security-opt mask=/foo/bar:/second/path fedora bash (unmask) unmask ALL . mask . $ podman run --security-opt unmask=ALL fedora bash proc/ unmask /proc/* . $ podman run --security-opt unmask=/proc/* fedora bash $ podman run --security-opt unmask=/foo/bar:/sys/firmware fedora bash --blkio-weight-device $ podman run -it --blkio-weight-device "/dev/sda:200" ubuntu (pipe) $ echo "asdf" | podman run --rm -i --entrypoint /bin/cat someimage asdf # podman run --userns=auto:size=65536 ubi8-micro cat /proc/self/uid_map 0 2147483647 65536 # podman run --userns=auto:size=65536 ubi8-micro cat /proc/self/uid_map 0 2147549183 65536 (Sysctls) --sysctl (sysctl) . IP : $ podman run --sysctl net.ipv4.ip_forward=1 someimage sysctl . sysctl . sysctl . --sysctl sysctl . UID/GID UID GID . $ podman run --uidmap 0:30000:7000 --gidmap 0:30000:7000 fedora echo hello /etc/container/storage.conf . busybox . podman --log-level=debug --storage-opt "additionalimagestore=/tmp/readonly-images" run busybox /bin/sh $ podman run --tz=local alpine date $ podman run --tz=Asia/Shanghai alpine date $ podman run --tz=US/Eastern alpine date container1 container2 . podman run container2 . $ podman create --name container1 -t -i fedora bash $ podman run --name container2 --requires container1 -t -i fedora bash . $ podman create --name container1 -t -i fedora bash $ podman create --name container2 -t -i fedora bash $ podman run --name container3 --requires container1,container2 -t -i fedora bash $ podman run -v /var/lib/design:/var/lib/design --group-add keep-groups ubi8 personality $ podman run --name container1 --personality=LINUX32 fedora bash rootfs overlay $ podman run --name container1 --rootfs /path/to/rootfs:O bash UTC TZ . --tz . # Example run podman run -ti --rm -e TZ=EST mytzimage lrwxrwxrwx. 1 root root 29 Nov 3 08:51 /etc/localtime -> ../usr/share/zoneinfo/Etc/UTC Now with default timezone: Fri Nov 19 18:10:55 EST 2021 Java default sees the following timezone: 2021-11-19T18:10:55.651130-05:00 Forcing UTC: Fri Nov 19 23:10:55 UTC 2021 ( net1 net2) $ podman run --network net1:ip=10.89.1.5 --network net2:ip=10.89.10.10 alpine ip addr $ podman create -d --name healthcheck-example -p 8080:80 --health-cmd '["CMD-SHELL","wget -q --spider http://127.0.0.1:80 || exit 1"]' --health-interval 30s --health-timeout 5s --health-retries 3 docker.io/library/nginx:alpine $ podman inspect healthcheck-example | jq '.[0].State.Health' (Rootless Containers) . shadow-utils . shadow-utils newuidmap(1) newgidmap(1) . /etc/subuid /etc/subgid UID . fuse-overlayfs . fuse-overlayfs overlay vfs . VPN pasta --network=host . (ENVIRONMENT) ( ): o : . o --http-proxy: http_proxy no_proxy. --http-proxy . o --env-host: . o --env-file: env-files. . o --env: . * . glob * : $ export ENV1=a $ podman run --env 'ENV*' alpine env | grep ENV ENV1=a $ podman run --env 'ENV*=b' alpine env | grep ENV ENV*=b (CONMON) conmon OCI Runtime . Conmon (container monitor) . . tty . (detached / ) conmon . conmon . Conmon . conmon conmon(8) . (FILES) /etc/subuid /etc/subgid : TMPDIR . /var/tmp . (SEE ALSO) podman(1), podman-save(1), podman-ps(1), podman-attach(1), podman-pod- create(1), podman-port(1), podman-start(1), podman-kill(1), podman- stop(1), podman-generate-systemd(1), podman-rm(1), subgid(5), subuid(5), containers.conf(5), podman-systemd.unit(5), setsebool(8), pasta(1), fuse-overlayfs(1), proc(5), conmon(8), personality(2) (Troubleshooting) podman-troubleshooting(7) . podman-rootless(7) . (HISTORY) (Kunal Kushwaha) (Sally O'Malley) (Sven Dowideit) (William Henry) docker.com . (FOOTNOTES) 1: . master slave . . . podman-run(1)