When --group-add keep-groups (or GroupAdd=keep-groups in Quadlet) is
used, supplementary groups are inherited from the calling process. When
Podman is launched via a systemd user service, the calling process is
the systemd --user manager, which only has the groups assigned to the
user at the time the manager was started.
If the user was added to new groups after the systemd user session
started (e.g. via usermod), those groups will not be visible to the
container. This is expected Linux process credential behavior, but was
undocumented, causing confusion for Quadlet users.
Add notes to both option and Quadlet docs explaining this behavior and
the workaround (restarting the user's systemd manager).
Fixes: #27876
Signed-off-by: Satwik Sai Prakash Sahoo <sahoospsatwik@gmail.com>
With netavark v2 we require true not 1.
This was correctly changed in commit bb02e49080 but then reverted in
commit 7612af4c0e again as it did not properly rebase and solve the
conflicts.
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
The docs, the create/run --help text and the shell completion all show
"bind" as the main/default value for --image-volume. That's wrong: the
accepted values are ignore | tmpfs | anonymous
(pkg/specgen/container_validate.go), the default is anonymous
(pkg/specgen/specgen.go), and "bind" is only a deprecated alias the code
maps to anonymous (pkg/specgenutil/specgen.go,
pkg/specgen/generate/kube/kube.go).
Show "anonymous" everywhere (options man page, the Quadlet ImageVolume=
key, --help, completion) and note that "bind" still works as a deprecated
alias. Behavior is unchanged.
Fixes: #27674
Signed-off-by: Grzegorz Szczepanczyk <g.szczepanczyk@getprintbox.com>
This patch adds retry plumbing for podman manifest push.
CLI flags added: --retry and --retry-delay
Flags are read into ImagePushOptions and passed through the local ABI path
Remote clients and REST API now respect retry settings (retry / retryDelay)
retry-delay is parsed with time.ParseDuration
Defaults fall back to containers.conf when the flags are not set
Updated manpages, Swagger comments, and e2e tests to validate retry behavior
Fixes: #28590
Signed-off-by: Valen Torassa <valentintorassacolombero@gmail.com>
Extract the --reload-systemd option text into a shared option file
at docs/source/markdown/options/reload-systemd.md and reference it
with @@option in both podman-quadlet-install and podman-quadlet-rm
manpages, following the established pattern for shared options.
Rename the manpages from .md to .md.in to indicate preprocessing.
Fixes#28370
Signed-off-by: Kit Dallege <xaum.io@gmail.com>
Clarify that auto-generated names may use underscores, that DNS-enabled
networks resolve container names as given, and that container_name_as_hostname
changes the UTS hostname only.
Fixes: https://github.com/containers/podman/issues/28754
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
Buildah v1.44.0 now uses --compression-format, --compression-level, and
--force-compression options. Add these options to the build and farm
man pages.
Signed-off-by: Tom Sweeney <tsweeney@redhat.com>
This commit does the following:
- Splits the podman-systemd.unit.5.md into multiple files - one for each quadlet file type.
- Adds the podman-quadlet-basic-usage.7.md for quadlet examples.
- Majority of the text in the new files is copied from the podman-systemd.unit.5.md
- Adds support for very simple condditional in the markdown_preprocess.
- Uses new logic in markdown_preprocess in options/*.md to use a single .md file for both
podman subcommands man-pages and quadlet man-pages. This deduplicates the Quadlet man-pages a lot.
- Adds new `@@option quadlet:source.md`` preprocess command to import such .md files from options directory.
Signed-off-by: Jan Kaluza <jkaluza@redhat.com>
These are two new Buildah flags that we need to wire into Podman
(both local and remote) and document, with the interesting note
that one requires the other and a check needed to be added for
that.
Also: secret parsing was tightened up in Buildah, and was
breaking the remote build tests. Rewire it to use the new parser
Buildah made, which ends up simplifying the code considerably.
Tests are back to passing afterwards.
Signed-off-by: Matthew Heon <matthew.heon@pm.me>
Update all documentation files to remove slirp4netns references
and update to pasta as the only rootless networking backend.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
Add tests for multiple static IPs per container across single and multi-subnet networks.
Document --network option for comma-separated IPs and subnet-based IP ordering.
Fixes: https://issues.redhat.com/browse/RHEL-98277
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
This allows things like compose project names to be associated with log
messages and later used in log processing and analysis.
Signed-off-by: Povilas Kanapickas <povilas@radix.lt>
Quadlet list always reports the heading, even when using custom
formatting strings. This doesn't follow the behavior of other podman
list commands. Borrow some logic and the "--noheading" flag from the
container list command to make this behavior uniform.
Signed-off-by: Randolph Sapp <rs@ti.com>
Add a per-volume 'nocreate' option that prevents automatic creation of
named volumes when they don't exist. When specified, Podman will fail
if the volume is not found instead of creating it automatically.
Usage: -v myvolume:/data:nocreate
--mount type=volume,src=myvolume,dst=/data,nocreate
See: #27862
Signed-off-by: Ygal Blum <ygal.blum@gmail.com>
Pass --mount settings and the contents of the --source-policy-file
argument to remote builds.
Signed-off-by: Nalin Dahyabhai <nalin@redhat.com>
Signed-off-by: Paul Holzinger <pholzing@redhat.com>
Removed all CNI-specific documentation from man pages:
- podman.1.md: Simplified --network-config-dir to only mention
netavark directories
- podman-network.1.md: Removed dual backend description, now states
netavark is the only backend
- podman-network-create.1.md: Removed CNI-specific notes about DNS
and DHCP socket configuration
- podman-network-connect.1.md: Removed CNI limitation note about
network aliases
- options/network-alias.md: Removed CNI limitation note about
network aliases
- podman-info.1.md: Updated example output to show netavark backend
information instead of CNI
All man pages now reflect netavark as the sole network backend.
Signed-off-by: Lokesh Mandvekar <lsm5@redhat.com>
- Update documentation: Differentiate `unless-stopped` from `always` - containers stopped by the user before a reboot will not restart.
- Add `should-start-on-boot` filter: Identify containers that require a restart after a system reboot.
- Update command documentation: Add `restart-policy` and `label!` filters to the documentation for container commands (rm, ps, start, stop, pause, unpause, restart).
- Add `restart-policy` and `shoud-start-on-boot` to completions.
- Update service: Update `podman-restart.service` to use the `needs-restart=true` filter.
- Preserve state: Preserve the `StoppedByUser` state across reboots.
- Update API: Add a `ShouldStartOnBoot()` method to the Container API.
- Update documentation: Add descriptions for the `should-start-on-boot` filter.
Fixes: https://issues.redhat.com/browse/RHEL-129405
Fixes: https://github.com/containers/podman/issues/20418
Signed-off-by: Jan Rodák <hony.com@seznam.cz>
