The value given to --ulimit is passed to the container unchanged and is
interpreted by setrlimit(2), so size limits such as memlock are in bytes.
The ulimit shell builtin scales most of those values when printing them
(kbytes for -d, -l, -m, -s, 512-byte blocks for -c, -f), which makes the
value reported inside the container look wrong.
Document the unit used by each limit type, add an example, and note that
unit suffixes are not accepted. No behavior change.
Fixes: #25236
Signed-off-by: i-OmSharma <sharmaom1201@gmail.com>
podman events --filter network=<name> was unconditionally returning
'NETWORK is an invalid filter' because the NETWORK case was absent
from the generateEventFilter switch statement in filters.go.
All other first-class event types (container, image, pod, volume)
had corresponding filter cases, but the Network type - despite being
fully defined in config.go along with NetworkConnect/NetworkDisconnect
statuses and the Event.Network field - had no handler.
Add the NETWORK case to filter by network name (e.Network), consistent
with Docker's --filter network= behaviour. ID-prefix matching is
intentionally omitted: for network connect/disconnect events e.ID
holds the container ID, not the network ID, so prefix matching would
only work for create/remove events and silently miss join/leave events.
Also add unit tests (filters_test.go), integration tests
(test/e2e/events_test.go, test/system/090-events.bats), shell
completion support for --filter network= (completion.go), and
document the new filter key in the man page.
Fixes: https://github.com/podman-container-tools/podman/issues/29387
Signed-off-by: Aftab Ali <aftab123215@gmail.com>
A rootless user can bind-mount a directory whose parent is mode 700 when
that parent is owned by a UID inside their /etc/subuid range, and gets
"statfs ...: permission denied" when the same parent is owned by root.
The user has no access to the parent in either case, and nothing in the
docs explains the difference.
The reason is the user namespace. CAP_DAC_OVERRIDE bypasses a file's
mode only when that file's UID and GID are both mapped in the namespace,
which is "Operation of file-related capabilities" in user_namespaces(7).
A parent whose owner is not mapped is reported with the overflow ID
65534, so root gets no DAC override and the parent's mode is enforced.
An owner inside the subordinate range is mapped, the override applies,
and mode 700 is bypassed. --userns=keep-id changes none of the outcomes.
The report that prompted this was a rootless bind mount of a directory
under /etc/letsencrypt, owned by certbot:certbot with mode 750, by a
user who is not in that group, and a question about whether that is
intentional. The "Using volumes" section explains the ID shift for files
created inside the container and says nothing about whether the mount
source can be traversed, which is the part the reporter hit.
Add a short subsection there that opens with the capability rule and
shows three cases as one rule: mode 755 owned by root mounts fine
because world permissions already allow it, mode 700 owned by root
fails, and mode 700 owned by an ID inside the range succeeds. It also
gives the podman unshare check for whether a UID is mapped, and the
consequence for subordinate ranges that overlap real accounts.
Behavior checked on Debian with podman 5.4.2 and a 100000:65536 range.
Discussion: https://github.com/podman-container-tools/podman/discussions/29443
Signed-off-by: José M. Requena Plens <jmrplens@gmail.com>
Built as a general podman machine custom OS tutorial but using the
architectures use case as an example.
Related to #29688
Signed-off-by: Jason Frey <fryguy9@gmail.com>
Do not set RemainAfterExit=yes by default when converting Quadlet
.volume files to systemd oneshot services.
Setting RemainAfterExit=yes causes systemd to consider the volume
service active even after the volume is deleted manually, preventing
systemd from re-executing volume creation when dependent container
services restart.
Fixes#27862
Signed-off-by: Sachin Mahajan <sachinmahajan903@gmail.com>
When pushing a manifest list, --platform=OS[/Arch[/Variant]] selects and pushes a single platform-specific manifest instead of the entire list.
Also, update compat POST /images/{name}/push to support the platform param (Compat v1.46)
Signed-off-by: Ashley Cui <acui@redhat.com>
Problem: podman artifact ls has no way to print just artifact
identifiers. Scripts that want to act on artifacts (e.g. remove them)
have to parse table output or use --format {{.Digest}}. Every other
listing command in podman (images, ps, artifact push/pull) already
supports -q/--quiet for this.
Impact: users can now run `podman artifact ls --quiet` to get one
digest per line, no header, suitable for piping into other podman
commands.
Change: adds a --quiet/-q bool flag to the list command. When set (and
--format is not also given), output.Digest is printed for each
artifact instead of the table.
Signed-off-by: umar11b <uzaman2018@gmail.com>
Several of the examples given for `podman manifest add` were missing the manifest name argument and one had a `sudo` prefix.
Signed-off-by: Jonathan Dowland <jdowland@redhat.com>
Document the default_host_ips option here to make it more visible. And
clarify the default v4/v6 bind behavior.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The 'podman artifact ls' command supports a --format flag accepting a go template string. Some commands (eg 'podman image ls') accept a --format=json parameter, and export pure json object to stdout.
This change adds a --format=json output mode to artifact lists too.
Includes simple documentation mention of --format=json option alongside go template description.
Signed-off-by: ellieayla <1447600+me@users.noreply.github.com>
podman farm build pushes each per-arch image to the registry by
appending `UnknownDigestSuffix` to the image specified using --tag. This
fails because a tag is not expected when UnknownDigestSuffix is used.
Parse the image reference and pass only the untagged image
reference when podman does this suffixed push to the registry.
Fixes#25039
Co-authored-by: Kevin Crocombe <kevin.crocombe@pegortech.co.uk>
Signed-off-by: Danish Prakash <contact@danishpraka.sh>
Remove hardcoded configuration file directory paths from podman.1.md and podman-image-trust.1.md.in. Instead of hardcoding paths that become outdated, direct readers to their respective man pages (such as containers.conf(5) and containers-policy.json(5)) for complete path resolution details.
Fixes: #29187
Signed-off-by: hihry <work.himanshu.r.v@gmail.com>
Signed-off-by: Himanshu Ravindra Iwanati <work.himanshu.r.v@gmail.com>
The farm command is helpful when it comes to building
multi-architecture container images, with a build out on various
different CPU architecture machines (e.g. amd64, arm64 etc). This
produces a multi-architecture image usable on many different kinds
of machines. Once those farms are built, we can list them out (ls)
in a human readable format.
Currently, podman farm list prints out every field (name,
connections, default, etc). The --quiet/-q flags cut the noise by
only printing the names of the farms, rather than all the other
farm list metadata.
The benefit of having this feature is for automation and scripts to
pull just the farm names from the list, which is mostly important
for CI pipelines to loop over.
Signed-off-by: umar11b <uzaman2018@gmail.com>
They are currently not shown anywhere so they provide no real value to
end users. They also have not been updated since they were added three
years ago.
Most users never update markdown.po but some did so that creates
unnecessary diffs on PRs for things that add no value.
To avoid that lets just remove them, as discussed at the community
meeting on Aug 13 2026. We are not against having translations again in
the future but it would need to have a proper process in place with
active people maintaining them and so that it shows up somewhere useful.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The Pod key of a .container unit accepts systemd specifiers, but handlePod
looked the referenced pod up in the units map using the raw value, so
"Pod=%N.pod" failed with "quadlet pod unit %N.pod does not exist" instead
of resolving to the pod named after the container's service.
Expand %N to the container's service name before the lookup, matching the
existing handling in GetContainerResourceName. Since %N is the service
name, setting ServiceName= lets the container and pod unit files use
different names.
Add e2e cases for both combinations: a pod named after the container
file, and a pod named after a ServiceName that differs from the file
name.
Fixes: #29108
Signed-off-by: Salih Muhammed <root@lr0.org>
ignore warn and strict modes for unknown yaml fields and kinds
ignore is the default and skips them warn reports them strict fails
warnings are returned in the play report so they show up in the cli and over the api for tools like podman desktop
Closes#18332
Signed-off-by: ROKUMATE <rohitkumawat0110@gmail.com>
When --group-add keep-groups (or GroupAdd=keep-groups in Quadlet) is
used, supplementary groups are inherited from the calling process. When
Podman is launched via a systemd user service, the calling process is
the systemd --user manager, which only has the groups assigned to the
user at the time the manager was started.
If the user was added to new groups after the systemd user session
started (e.g. via usermod), those groups will not be visible to the
container. This is expected Linux process credential behavior, but was
undocumented, causing confusion for Quadlet users.
Add notes to both option and Quadlet docs explaining this behavior and
the workaround (restarting the user's systemd manager).
Fixes: #27876
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
Run markdown-preprocess before pandoc (same as make docs), prefer
generated .md over .md.in, and rename podman-remote.html to podman.html
like remote-docs.sh so Windows winmake docs match the Linux path.
Assisted-by: Cursor
Signed-off-by: Gunjan Vyas <gvyas@redhat.com>
Document that only the Podman database is transient, not volume data on
disk. After a reboot, volumes created under --transient-store lose their
database entries but the underlying data persists and can be reused.
Mention podman system prune --external for cleaning up orphaned volume
data, and note that it should be used consistently across all commands.
Fixes: #25295
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
Clarify that the compose_providers and compose_warning_logs settings belong in the [engine] table of containers.conf.
Fixes: #29122
Signed-off-by: MayorFaj <mayorfaj@gmail.com>
