The 'podman artifact ls' command supports a --format flag accepting a go template string. Some commands (eg 'podman image ls') accept a --format=json parameter, and export pure json object to stdout.
This change adds a --format=json output mode to artifact lists too.
Includes simple documentation mention of --format=json option alongside go template description.
Signed-off-by: ellieayla <1447600+me@users.noreply.github.com>
podman farm build pushes each per-arch image to the registry by
appending `UnknownDigestSuffix` to the image specified using --tag. This
fails because a tag is not expected when UnknownDigestSuffix is used.
Parse the image reference and pass only the untagged image
reference when podman does this suffixed push to the registry.
Fixes#25039
Co-authored-by: Kevin Crocombe <kevin.crocombe@pegortech.co.uk>
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
Remove hardcoded configuration file directory paths from podman.1.md and podman-image-trust.1.md.in. Instead of hardcoding paths that become outdated, direct readers to their respective man pages (such as containers.conf(5) and containers-policy.json(5)) for complete path resolution details.
Fixes: #29187
Signed-off-by: hihry <work.himanshu.r.v@gmail.com>
Signed-off-by: Himanshu Ravindra Iwanati <work.himanshu.r.v@gmail.com>
The farm command is helpful when it comes to building
multi-architecture container images, with a build out on various
different CPU architecture machines (e.g. amd64, arm64 etc). This
produces a multi-architecture image usable on many different kinds
of machines. Once those farms are built, we can list them out (ls)
in a human readable format.
Currently, podman farm list prints out every field (name,
connections, default, etc). The --quiet/-q flags cut the noise by
only printing the names of the farms, rather than all the other
farm list metadata.
The benefit of having this feature is for automation and scripts to
pull just the farm names from the list, which is mostly important
for CI pipelines to loop over.
Signed-off-by: umar11b <uzaman2018@gmail.com>
They are currently not shown anywhere so they provide no real value to
end users. They also have not been updated since they were added three
years ago.
Most users never update markdown.po but some did so that creates
unnecessary diffs on PRs for things that add no value.
To avoid that lets just remove them, as discussed at the community
meeting on Aug 13 2026. We are not against having translations again in
the future but it would need to have a proper process in place with
active people maintaining them and so that it shows up somewhere useful.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The Pod key of a .container unit accepts systemd specifiers, but handlePod
looked the referenced pod up in the units map using the raw value, so
"Pod=%N.pod" failed with "quadlet pod unit %N.pod does not exist" instead
of resolving to the pod named after the container's service.
Expand %N to the container's service name before the lookup, matching the
existing handling in GetContainerResourceName. Since %N is the service
name, setting ServiceName= lets the container and pod unit files use
different names.
Add e2e cases for both combinations: a pod named after the container
file, and a pod named after a ServiceName that differs from the file
name.
Fixes: #29108
Signed-off-by: Salih Muhammed <root@lr0.org>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
When --group-add keep-groups (or GroupAdd=keep-groups in Quadlet) is
used, supplementary groups are inherited from the calling process. When
Podman is launched via a systemd user service, the calling process is
the systemd --user manager, which only has the groups assigned to the
user at the time the manager was started.
If the user was added to new groups after the systemd user session
started (e.g. via usermod), those groups will not be visible to the
container. This is expected Linux process credential behavior, but was
undocumented, causing confusion for Quadlet users.
Add notes to both option and Quadlet docs explaining this behavior and
the workaround (restarting the user's systemd manager).
Fixes: #27876
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
Document that only the Podman database is transient, not volume data on
disk. After a reboot, volumes created under --transient-store lose their
database entries but the underlying data persists and can be reused.
Mention podman system prune --external for cleaning up orphaned volume
data, and note that it should be used consistently across all commands.
Fixes: #25295
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
Clarify that the compose_providers and compose_warning_logs settings belong in the [engine] table of containers.conf.
Fixes: #29122
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
Use of the `podman --root` option unexpectedly cleared the default
storage options from the configuration file and environment variable.
Make sure to document this behavior with the `--storage-opt` option.
This behavior changed in commit 55f00bac02 ("Clear the storage-options
from the graphdriver if users specifies --root", v3.3.0).
Fix `--root` and `--storage-driver` docs, there is no `storage-opt`
setting in `containers-storage.conf(5)`. Use `storage.options.<driver>`
instead of `storage.options.*` to avoid implying that
`storage.options.pull_options` would also be ignored.
Signed-off-by: Peter Wu <peter@lekensteyn.nl>
The netavark mention is not needed as we only support it now. Then
update it for the new route type syntax which was not documented in
commit daaf8b62ba.
Also add an example and a note that containers with CAP_NET_ADMIN can
alter routes still.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
With netavark v2 we require true not 1.
This was correctly changed in commit bb02e49080 but then reverted in
commit 7612af4c0e again as it did not properly rebase and solve the
conflicts.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
We renamed the variant in machine-os to podman-machine-os so it is not
coreos:
a5c8fbcfc6
Now the main issue with this is the code runs inside the VM, which means
updates from 6.0.0 to the next one still will be broken and needs the os
apply command until this can work again. Of course a new init will also
work with the new image.
Fixes: #29085
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The docs, the create/run --help text and the shell completion all show
"bind" as the main/default value for --image-volume. That's wrong: the
accepted values are ignore | tmpfs | anonymous
(pkg/specgen/container_validate.go), the default is anonymous
(pkg/specgen/specgen.go), and "bind" is only a deprecated alias the code
maps to anonymous (pkg/specgenutil/specgen.go,
pkg/specgen/generate/kube/kube.go).
Show "anonymous" everywhere (options man page, the Quadlet ImageVolume=
key, --help, completion) and note that "bind" still works as a deprecated
alias. Behavior is unchanged.
Fixes: #27674
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
NormalizeVolumePruneFilters discarded every query filter when the "all"
pseudo-filter was set, deleting label/label!/until before they reached the
volume filter generator. As a result `podman volume prune --all --filter
label=foo` ignored the label and pruned every unused volume.
"all" only widens the prune scope from anonymous-only to all unused volumes;
it is orthogonal to the label filters, which must still select which of those
volumes are removed. Drop only the "all" key and keep the remaining filters so
they continue to apply.
NormalizeVolumePruneFilters is shared by the local (abi), remote (libpod API),
and Docker-compat prune paths, so all three were affected.
Signed-off-by: Shuai Yuan <shuaiyuanzju@gmail.com>
One problem with the swagger upload is we need an extra bucket and then
we need our own custom version schema and selector on the website. If we
can just embed the swagger.yml as part of the official build we can get
rid of all of that and have a much simpler way as the regular
readthedocs version selector will work.
We also no longer need to maintain an extra bucket upload and no longer
need to update the version list which was forgotten all the time.
Fixes: #28827
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
This reverts commit 858150288f.
In the next commit I add a custom build for the swagger yaml which adds
it as part of the main readthedocs build so we can use the default
version selector and drop our custom workarounds.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Podman remote clients don't support loading images from directories,
this patch aims to make that clearer.
This patch also aims to make it clearer that podman-load can load from
URLs, directories and tar archives.
Drop incorrect claims that --input is required on remote clients
(stdin reading is supported) and avoid 'Linux only' wording since
podman has native FreeBSD support.
Fixes: https://github.com/containers/podman/issues/27952
Signed-off-by: Lewis Denny <lewisdenny@me.com>
When checkpointing a container with --leave-running, libpod dumps the
container's memory via the OCI runtime (CRIU) first and only captures
the rootfs diff and named volumes afterwards. CRIU thaws the container
as soon as the memory dump finishes, so the processes inside the
container continue to run between the memory snapshot and the
file-system capture. As a result, the checkpoint can be inconsistent:
have CRIU images and a file system that reflect different points in time.
To fix this, we freeze the container's cgroup before invoking the OCI
runtime and thaw it again only after the checkpoint image/archive has
been written. The OCI runtime calls CRIU with the freezer cgroup and
restores it to its previous state once the dump completes, so a
container that was already frozen stays frozen across the dump and
the file system is captured at the same instant as the CRIU images.
This mirrors the approach other engines (e.g. CRI-O and containerd).
The default (stopping) checkpoint functionality is not affected by this
issue because CRIU leaves the tasks dead after the dump.
This patch also adds a regression test for the consistency of live
(--leave-running) checkpoints. The container runs a workload that
keeps an in-memory counter in sync with a value written to a file
on its root file system, maintaining the invariant that the on-disk
value never gets ahead of the in-memory counter.
Signed-off-by: Radostin Stoyanov <rstoyanov@fedoraproject.org>
