erabo/spiegel_podman
1
0
Fork 0
mirror of https://github.com/podman-container-tools/podman.git synced 2026-08-05 00:15:44 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

docs: improve docs on relabelling options of --mount

Browse source 
Resolves #29124.

Signed-off-by: cyqsimon <28627918+cyqsimon@users.noreply.github.com>
This commit is contained in:
cyqsimon 2026-07-07 20:20:40 +08:00
parent f466791b6f
commit bd753bfe2e
No known key found for this signature in database
GPG key ID: 3502E742F8BAAB7D
1 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
docs/source/markdown/options/mount.md
View file

@ -76,6 +76,11 @@ Options specific to type=**volume**:
- *subpath*: Mount only a specific subpath within the volume, instead of the whole volume.
- *relabel*: *shared*, *private*. Recursively walk the mount and set the security system (e.g. SELinux) label on each file to grant access permissions from the container context.
*shared* applies a label that grants permissions to all containers, while *private* applies a label that grants permissions to this specific container.
- *z*, *Z*: shorthand for *relabel=shared* and *relabel=private*, respectively.
- *idmap*: If specified, create an idmapped mount to the target user namespace in the container.
The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users.
The idmap option supports a custom mapping that can be different from the user namespace used by the container.
@ -98,7 +103,10 @@ Options specific to **bind** and **glob**:
- *bind-nonrecursive*: do not set up a recursive bind mount. By default it is recursive.
- *relabel*: *shared*, *private*.
- *relabel*: *shared*, *private*. Recursively walk the mount and set the security system (e.g. SELinux) label on each file to grant access permissions from the container context.
*shared* applies a label that grants permissions to all containers, while *private* applies a label that grants permissions to this specific container.
- *z*, *Z*: shorthand for *relabel=shared* and *relabel=private*, respectively.
- *idmap*: If specified, create an idmapped mount to the target user namespace in the container.
The idmap option is only supported by Podman in rootful mode. The Linux kernel does not allow the use of idmapped file systems for unprivileged users.