github.com/containers/podman/v2@v2.2.2-0.20210501105131-c1e07d070c4c/README.md (about)

     1  ![PODMAN logo](logo/podman-logo-source.svg)
     2  
     3  # Podman: A tool for managing OCI containers and pods
     4  
     5  Podman (the POD MANager) is a tool for managing containers and images, volumes mounted into those containers, and pods made from groups of containers.
     6  Podman is based on libpod, a library for container lifecycle management that is also contained in this repository. The libpod library provides APIs for managing containers, pods, container images, and volumes.
     7  
     8  * [Latest Version: 2.1.1](https://github.com/containers/podman/releases/latest)
     9    * Latest Remote client for Windows
    10    * Latest Remote client for MacOs
    11    * Latest Static Remote client for Linux
    12  
    13  * Continuous Integration: [![Build Status](https://api.cirrus-ci.com/github/containers/podman.svg)](https://cirrus-ci.com/github/containers/podman/master)
    14  * [GoDoc: ![GoDoc](https://godoc.org/github.com/containers/podman/libpod?status.svg)](https://godoc.org/github.com/containers/podman/libpod)
    15  
    16  ## Overview and scope
    17  
    18  At a high level, the scope of Podman and libpod is the following:
    19  
    20  * Support for multiple container image formats, including OCI and Docker images.
    21  * Full management of those images, including pulling from various sources (including trust and verification), creating (built via Containerfile or Dockerfile or committed from a container), and pushing to registries and other storage backends.
    22  * Full management of container lifecycle, including creation (both from an image and from an exploded root filesystem), running, checkpointing and restoring (via CRIU), and removal.
    23  * Support for pods, groups of containers that share resources and are managed together.
    24  * Support for running containers and pods without root or other elevated privileges.
    25  * Resource isolation of containers and pods.
    26  * Support for a Docker-compatible CLI interface.
    27  * No manager daemon, for improved security and lower resource utilization at idle.
    28  * Support for a REST API providing both a Docker-compatible interface and an improved interface exposing advanced Podman functionality.
    29  * In the future, integration with [CRI-O](https://github.com/cri-o/cri-o) to share containers and backend code.
    30  
    31  Podman presently only supports running containers on Linux. However, we are building a remote client which can run on Windows and OS X and manage Podman containers on a Linux system via the REST API using SSH tunneling.
    32  
    33  ## Roadmap
    34  
    35  1. Further improvements to the REST API, with a focus on bugfixes and implementing missing functionality
    36  1. Integrate libpod into [CRI-O](https://github.com/cri-o/cri-o) to replace its existing container management backend
    37  1. Improvements on rootless containers, with a focus on improving the user experience and exposing presently-unavailable features when possible
    38  
    39  ## Communications
    40  
    41  If you think you've identified a security issue in the project, please *DO NOT* report the issue publicly via the Github issue tracker, mailing list, or IRC.
    42  Instead, send an email with as many details as possible to `security@lists.podman.io`. This is a private mailing list for the core maintainers.
    43  
    44  For general questions and discussion, please use the
    45  IRC `#podman` channel on `irc.freenode.net`.
    46  
    47  For discussions around issues/bugs and features, you can use the GitHub
    48  [issues](https://github.com/containers/podman/issues)
    49  and
    50  [PRs](https://github.com/containers/podman/pulls)
    51  tracking system.
    52  
    53  There is also a [mailing list](https://lists.podman.io/archives/) at `lists.podman.io`.
    54  You can subscribe by sending a message to `podman-join@lists.podman.io` with the subject `subscribe`.
    55  
    56  ## Rootless
    57  Podman can be easily run as a normal user, without requiring a setuid binary.
    58  When run without root, Podman containers use user namespaces to set root in the container to the user running Podman.
    59  Rootless Podman runs locked-down containers with no privileges that the user running the container does not have.
    60  Some of these restrictions can be lifted (via `--privileged`, for example), but rootless containers will never have more privileges than the user that launched them.
    61  If you run Podman as your user and mount in `/etc/passwd` from the host, you still won't be able to change it, since your user doesn't have permission to do so.
    62  
    63  Almost all normal Podman functionality is available, though there are some [shortcomings](https://github.com/containers/podman/blob/master/rootless.md).
    64  Any recent Podman release should be able to run rootless without any additional configuration, though your operating system may require some additional configuration detailed in the [install guide](https://github.com/containers/podman/blob/master/install.md).
    65  
    66  A little configuration by an administrator is required before rootless Podman can be used, the necessary setup is documented [here](https://github.com/containers/podman/blob/master/docs/tutorials/rootless_tutorial.md).
    67  
    68  ## Out of scope
    69  
    70  * Specialized signing and pushing of images to various storage backends.
    71    See [Skopeo](https://github.com/containers/skopeo/) for those tasks.
    72  * Support for the Kubernetes CRI interface for container management.
    73    The [CRI-O](https://github.com/cri-o/cri-o) daemon specializes in that.
    74  * Supporting `docker-compose`.  We believe that Kubernetes is the defacto
    75    standard for composing Pods and for orchestrating containers, making
    76    Kubernetes YAML a defacto standard file format. Hence, Podman allows the
    77    creation and execution of Pods from a Kubernetes YAML file (see
    78    [podman-play-kube](https://github.com/containers/podman/blob/master/docs/source/markdown/podman-play-kube.1.md)).
    79    Podman can also generate Kubernetes YAML based on a container or Pod (see
    80    [podman-generate-kube](https://github.com/containers/podman/blob/master/docs/source/markdown/podman-generate-kube.1.md)),
    81    which allows for an easy transition from a local development environment
    82    to a production Kubernetes cluster. If Kubernetes does not fit your requirements,
    83    there are other third-party tools that support the docker-compose format such as
    84    [kompose](https://github.com/kubernetes/kompose/) and
    85    [podman-compose](https://github.com/muayyad-alsadi/podman-compose)
    86    that might be appropriate for your environment. This situation may change with
    87    the addition of the REST API.
    88  
    89  ## OCI Projects Plans
    90  
    91  The plan is to use OCI projects and best of breed libraries for different aspects:
    92  - Runtime: We use the [OCI runtime tools](https://github.com/opencontainers/runtime-tools) to generate OCI runtime configurations that can be used with any OCI-compliant runtime, like [crun](https://github.com/containers/crun/) and [runc](https://github.com/opencontainers/runc/).
    93  - Images: Image management uses the [containers/image](https://github.com/containers/image) library.
    94  - Storage: Container and image storage is managed by [containers/storage](https://github.com/containers/storage).
    95  - Networking: Networking support through use of [CNI](https://github.com/containernetworking/cni).
    96  - Builds: Builds are supported via [Buildah](https://github.com/containers/buildah).
    97  - Conmon: [Conmon](https://github.com/containers/conmon) is a tool for monitoring OCI runtimes, used by both Podman and CRI-O.
    98  - Seccomp: A unified [Seccomp](https://github.com/seccomp/containers-golang) policy for Podman, Buildah, and CRI-O.
    99  
   100  ## Podman Information for Developers
   101  
   102  For blogs, release announcements and more, please checkout the [podman.io](https://podman.io) website!
   103  
   104  **[Installation notes](install.md)**
   105  Information on how to install Podman in your environment.
   106  
   107  **[OCI Hooks Support](pkg/hooks/README.md)**
   108  Information on how Podman configures [OCI Hooks][spec-hooks] to run when launching a container.
   109  
   110  **[Podman API](http://docs.podman.io/en/latest/_static/api.html)**
   111  Documentation on the Podman REST API.
   112  
   113  **[Podman Commands](https://podman.readthedocs.io/en/latest/Commands.html)**
   114  A list of the Podman commands with links to their man pages and in many cases videos
   115  showing the commands in use.
   116  
   117  **[Podman Troubleshooting Guide](troubleshooting.md)**
   118  A list of common issues and solutions for Podman.
   119  
   120  **[Podman Usage Transfer](transfer.md)**
   121  Useful information for ops and dev transfer as it relates to infrastructure that utilizes Podman.  This page
   122  includes tables showing Docker commands and their Podman equivalent commands.
   123  
   124  **[Tutorials](docs/tutorials)**
   125  Tutorials on using Podman.
   126  
   127  **[Remote Client](https://github.com/containers/podman/blob/master/docs/tutorials/remote_client.md)**
   128  A brief how-to on using the Podman remote-client.
   129  
   130  **[Basic Setup and Use of Podman in a Rootless environment](https://github.com/containers/podman/blob/master/docs/tutorials/rootless_tutorial.md)**
   131  A tutorial showing the setup and configuration necessary to run Rootless Podman.
   132  
   133  **[Release Notes](RELEASE_NOTES.md)**
   134  Release notes for recent Podman versions.
   135  
   136  **[Contributing](CONTRIBUTING.md)**
   137  Information about contributing to this project.
   138  
   139  [spec-hooks]: https://github.com/opencontainers/runtime-spec/blob/v1.0.2/config.md#posix-platform-hooks
   140  
   141  ## Buildah and Podman relationship
   142  
   143  Buildah and Podman are two complementary open-source projects that are
   144  available on most Linux platforms and both projects reside at
   145  [GitHub.com](https://github.com) with Buildah
   146  [here](https://github.com/containers/buildah) and Podman
   147  [here](https://github.com/containers/podman).  Both, Buildah and Podman are
   148  command line tools that work on Open Container Initiative (OCI) images and
   149  containers.  The two projects differentiate in their specialization.
   150  
   151  Buildah specializes in building OCI images.  Buildah's commands replicate all
   152  of the commands that are found in a Dockerfile.  This allows building images
   153  with and without Dockerfiles while not requiring any root privileges.
   154  Buildah’s ultimate goal is to provide a lower-level coreutils interface to
   155  build images.  The flexibility of building images without Dockerfiles allows
   156  for the integration of other scripting languages into the build process.
   157  Buildah follows a simple fork-exec model and does not run as a daemon
   158  but it is based on a comprehensive API in golang, which can be vendored
   159  into other tools.
   160  
   161  Podman specializes in all of the commands and functions that help you to maintain and modify
   162  OCI images, such as pulling and tagging.  It also allows you to create, run, and maintain those containers
   163  created from those images.  For building container images via Dockerfiles, Podman uses Buildah's
   164  golang API and can be installed independently from Buildah.
   165  
   166  A major difference between Podman and Buildah is their concept of a container.  Podman
   167  allows users to create "traditional containers" where the intent of these containers is
   168  to be long lived.  While Buildah containers are really just created to allow content
   169  to be added back to the container image.  An easy way to think of it is the
   170  `buildah run` command emulates the RUN command in a Dockerfile while the `podman run`
   171  command emulates the `docker run` command in functionality.  Because of this and their underlying
   172  storage differences, you can not see Podman containers from within Buildah or vice versa.
   173  
   174  In short, Buildah is an efficient way to create OCI images while Podman allows
   175  you to manage and maintain those images and containers in a production environment using
   176  familiar container cli commands.  For more details, see the
   177  [Container Tools Guide](https://github.com/containers/buildah/tree/master/docs/containertools).
   178  
   179  ## Podman Legacy API (Varlink)
   180  Podman offers a [Varlink-based API](https://github.com/containers/podman/blob/master/docs/tutorials/varlink_remote_client.md)
   181  for remote management of containers. However, this API has been deprecated by the REST API.
   182  Varlink support is in maintenance mode, and will be removed in a future release.
   183  For more details, you can see [this blog](https://podman.io/blogs/2020/01/17/podman-new-api.html).
   184  
   185  ## Static Binary Builds
   186  The Cirrus CI integration within this repository contains a `static_build` job
   187  which produces a static Podman binary for testing purposes. Please note that
   188  this binary is not officially supported with respect to feature-completeness
   189  and functionality and should be only used for testing.