github.com/containers/podman/v2@v2.2.2-0.20210501105131-c1e07d070c4c/docs/source/markdown/podman.1.md (about) 1 % podman(1) 2 3 ## NAME 4 podman - Simple management tool for pods, containers and images 5 6 ## SYNOPSIS 7 **podman** [*options*] *command* 8 9 ## DESCRIPTION 10 Podman (Pod Manager) is a fully featured container engine that is a simple daemonless tool. 11 Podman provides a Docker-CLI comparable command line that eases the transition from other 12 container engines and allows the management of pods, containers and images. Simply put: `alias docker=podman`. 13 Most Podman commands can be run as a regular user, without requiring additional 14 privileges. 15 16 Podman uses Buildah(1) internally to create container images. Both tools share image 17 (not container) storage, hence each can use or manipulate images (but not containers) 18 created by the other. 19 20 Default settings for flags are defined in `containers.conf`. Most settings for 21 Remote connections use the server's containers.conf, except when documented in 22 man pages. 23 24 **podman [GLOBAL OPTIONS]** 25 26 ## GLOBAL OPTIONS 27 28 #### **--cgroup-manager**=*manager* 29 30 The CGroup manager to use for container cgroups. Supported values are cgroupfs or systemd. Default is systemd unless overridden in the containers.conf file. 31 32 Note: Setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type. 33 Note: CGroup manager is not supported in rootless mode when using CGroups Version V1. 34 35 #### **--cni-config-dir** 36 Path of the configuration directory for CNI networks. (Default: `/etc/cni/net.d`) 37 38 #### **--connection**, **-c** 39 Connection to use for remote podman (Default connection is configured in `containers.conf`) 40 Remote connections use local containers.conf for default. 41 42 #### **--conmon** 43 Path of the conmon binary (Default path is configured in `containers.conf`) 44 45 #### **--events-backend**=*type* 46 47 Backend to use for storing events. Allowed values are **file**, **journald**, and **none**. 48 49 #### **--help**, **-h** 50 51 Print usage statement 52 53 #### **--hooks-dir**=*path* 54 55 Each `*.json` file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see `oci-hooks(5)`. Podman and libpod currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. 56 57 This option may be set multiple times; paths from later options have higher precedence (`oci-hooks(5)` discusses directory precedence). 58 59 For the annotation conditions, libpod uses any annotations set in the generated OCI configuration. 60 61 For the bind-mount conditions, only mounts explicitly requested by the caller via `--volume` are considered. Bind mounts that libpod inserts by default (e.g. `/dev/shm`) are not considered. 62 63 If `--hooks-dir` is unset for root callers, Podman and libpod will currently default to `/usr/share/containers/oci/hooks.d` and `/etc/containers/oci/hooks.d` in order of increasing precedence. Using these defaults is deprecated, and callers should migrate to explicitly setting `--hooks-dir`. 64 65 Podman and libpod currently support an additional `precreate` state which is called before the runtime's `create` operation. Unlike the other stages, which receive the container state on their standard input, `precreate` hooks receive the proposed runtime configuration on their standard input. They may alter that configuration as they see fit, and write the altered form to their standard output. 66 67 **WARNING**: the `precreate` hook lets you do powerful things, such as adding additional mounts to the runtime configuration. That power also makes it easy to break things. Before reporting libpod errors, try running your container with `precreate` hooks disabled to see if the problem is due to one of your hooks. 68 69 #### **--identity**=*path* 70 71 Path to ssh identity file. If the identity file has been encrypted, podman prompts the user for the passphrase. 72 If no identity file is provided and no user is given, podman defaults to the user running the podman command. 73 Podman prompts for the login password on the remote server. 74 75 Identity value resolution precedence: 76 - command line value 77 - environment variable `CONTAINER_SSHKEY`, if `CONTAINER_HOST` is found 78 - `containers.conf` 79 Remote connections use local containers.conf for default. 80 81 #### **--log-level**=*level* 82 83 Log messages above specified level: debug, info, warn, error (default), fatal or panic (default: "error") 84 85 #### **--namespace**=*namespace* 86 87 Set libpod namespace. Namespaces are used to separate groups of containers and pods in libpod's state. 88 When namespace is set, created containers and pods will join the given namespace, and only containers and pods in the given namespace will be visible to Podman. 89 90 #### **--network-cmd-path**=*path* 91 Path to the command binary to use for setting up a network. It is currently only used for setting up a slirp4netns network. If "" is used then the binary is looked up using the $PATH environment variable. 92 93 #### **--remote**, **-r** 94 Access Podman service will be remote 95 Remote connections use local containers.conf for default. 96 97 #### **--url**=*value* 98 URL to access Podman service (default from `containers.conf`, rootless `unix://run/user/$UID/podman/podman.sock` or as root `unix://run/podman/podman.sock`). 99 100 - `CONTAINER_HOST` is of the format `<schema>://[<user[:<password>]@]<host>[:<port>][<path>]` 101 102 Details: 103 - `user` will default to either `root` or current running user 104 - `password` has no default 105 - `host` must be provided and is either the IP or name of the machine hosting the Podman service 106 - `port` defaults to 22 107 - `path` defaults to either `/run/podman/podman.sock`, or `/run/user/<uid>/podman/podman.sock` if running rootless. 108 109 URL value resolution precedence: 110 - command line value 111 - environment variable `CONTAINER_HOST` 112 - `containers.conf` 113 - `unix://run/podman/podman.sock` 114 Remote connections use local containers.conf for default. 115 116 #### **--root**=*value* 117 118 Storage root dir in which data, including images, is stored (default: "/var/lib/containers/storage" for UID 0, "$HOME/.local/share/containers/storage" for other users). 119 Default root dir configured in `/etc/containers/storage.conf`. 120 121 #### **--runroot**=*value* 122 123 Storage state directory where all state information is stored (default: "/var/run/containers/storage" for UID 0, "/var/run/user/$UID/run" for other users). 124 Default state dir configured in `/etc/containers/storage.conf`. 125 126 #### **--runtime**=*value* 127 128 Name of the OCI runtime as specified in containers.conf or absolute path to the OCI compatible binary used to run containers. 129 130 #### **--runtime-flag**=*flag* 131 132 Adds global flags for the container runtime. To list the supported flags, please 133 consult the manpages of the selected container runtime (`runc` is the default 134 runtime, the manpage to consult is `runc(8)`. When the machine is configured 135 for cgroup V2, the default runtime is `crun`, the manpage to consult is `crun(8)`.). 136 137 Note: Do not pass the leading `--` to the flag. To pass the runc flag `--log-format json` 138 to podman build, the option given would be `--runtime-flag log-format=json`. 139 140 #### **--storage-driver**=*value* 141 142 Storage driver. The default storage driver for UID 0 is configured in /etc/containers/storage.conf (`$HOME/.config/containers/storage.conf` in rootless mode), and is *vfs* for non-root users when *fuse-overlayfs* is not available. The `STORAGE_DRIVER` environment variable overrides the default. The --storage-driver specified driver overrides all. 143 144 Overriding this option will cause the *storage-opt* settings in /etc/containers/storage.conf to be ignored. The user must 145 specify additional options via the `--storage-opt` flag. 146 147 #### **--storage-opt**=*value* 148 149 Storage driver option, Default storage driver options are configured in /etc/containers/storage.conf (`$HOME/.config/containers/storage.conf` in rootless mode). The `STORAGE_OPTS` environment variable overrides the default. The --storage-opt specified options overrides all. 150 151 #### **--syslog**=*true|false* 152 153 Output logging information to syslog as well as the console (default *false*). 154 155 On remote clients, logging is directed to the file $HOME/.config/containers/podman.log. 156 157 #### **--tmpdir** 158 159 Path to the tmp directory, for libpod runtime content. 160 161 NOTE --tmpdir is not used for the temporary storage of downloaded images. Use the environment variable `TMPDIR` to change the temporary storage location of downloaded container images. Podman defaults to use `/var/tmp`. 162 163 #### **--version**, **-v** 164 165 Print the version 166 167 ## Environment Variables 168 169 Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the `podman` commands. 170 171 ## Remote Access 172 173 The Podman command can be used with remote services using the `--remote` flag. Connections can 174 be made using local unix domain sockets, ssh or directly to tcp sockets. When specifying the 175 podman --remote flag, only the global options `--url`, `--identity`, `--log-level`, `--connection` are used. 176 177 Connection information can also be managed using the containers.conf file. 178 179 ## Exit Codes 180 181 The exit code from `podman` gives information about why the container 182 failed to run or why it exited. When `podman` commands exit with a non-zero code, 183 the exit codes follow the `chroot` standard, see below: 184 185 **125** The error is with podman **_itself_** 186 187 $ podman run --foo busybox; echo $? 188 Error: unknown flag: --foo 189 125 190 191 **126** Executing a _contained command_ and the _command_ cannot be invoked 192 193 $ podman run busybox /etc; echo $? 194 Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error 195 126 196 197 **127** Executing a _contained command_ and the _command_ cannot be found 198 $ podman run busybox foo; echo $? 199 Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error 200 127 201 202 **Exit code** _contained command_ exit code 203 204 $ podman run busybox /bin/sh -c 'exit 3'; echo $? 205 3 206 207 208 ## COMMANDS 209 210 | Command | Description | 211 | ------------------------------------------------ | --------------------------------------------------------------------------- | 212 | [podman-attach(1)](podman-attach.1.md) | Attach to a running container. | 213 | [podman-auto-update(1)](podman-auto-update.1.md) | Auto update containers according to their auto-update policy | 214 | [podman-build(1)](podman-build.1.md) | Build a container image using a Containerfile. | 215 | [podman-commit(1)](podman-commit.1.md) | Create new image based on the changed container. | 216 | [podman-completion(1)](podman-completion.1.md) | Generate shell completion scripts | 217 | [podman-container(1)](podman-container.1.md) | Manage containers. | 218 | [podman-cp(1)](podman-cp.1.md) | Copy files/folders between a container and the local filesystem. | 219 | [podman-create(1)](podman-create.1.md) | Create a new container. | 220 | [podman-diff(1)](podman-diff.1.md) | Inspect changes on a container or image's filesystem. | 221 | [podman-events(1)](podman-events.1.md) | Monitor Podman events | 222 | [podman-exec(1)](podman-exec.1.md) | Execute a command in a running container. | 223 | [podman-export(1)](podman-export.1.md) | Export a container's filesystem contents as a tar archive. | 224 | [podman-generate(1)](podman-generate.1.md) | Generate structured data based for a containers and pods. | 225 | [podman-healthcheck(1)](podman-healthcheck.1.md) | Manage healthchecks for containers | 226 | [podman-history(1)](podman-history.1.md) | Show the history of an image. | 227 | [podman-image(1)](podman-image.1.md) | Manage images. | 228 | [podman-images(1)](podman-images.1.md) | List images in local storage. | 229 | [podman-import(1)](podman-import.1.md) | Import a tarball and save it as a filesystem image. | 230 | [podman-info(1)](podman-info.1.md) | Displays Podman related system information. | 231 | [podman-init(1)](podman-init.1.md) | Initialize one or more containers | 232 | [podman-inspect(1)](podman-inspect.1.md) | Display a container, image, volume, network, or pod's configuration. | 233 | [podman-kill(1)](podman-kill.1.md) | Kill the main process in one or more containers. | 234 | [podman-load(1)](podman-load.1.md) | Load image(s) from a tar archive into container storage. | 235 | [podman-login(1)](podman-login.1.md) | Login to a container registry. | 236 | [podman-logout(1)](podman-logout.1.md) | Logout of a container registry. | 237 | [podman-logs(1)](podman-logs.1.md) | Display the logs of one or more containers. | 238 | [podman-manifest(1)](podman-manifest.1.md) | Create and manipulate manifest lists and image indexes. | 239 | [podman-mount(1)](podman-mount.1.md) | Mount a working container's root filesystem. | 240 | [podman-network(1)](podman-network.1.md) | Manage Podman CNI networks. | 241 | [podman-pause(1)](podman-pause.1.md) | Pause one or more containers. | 242 | [podman-play(1)](podman-play.1.md) | Play pods and containers based on a structured input file. | 243 | [podman-pod(1)](podman-pod.1.md) | Management tool for groups of containers, called pods. | 244 | [podman-port(1)](podman-port.1.md) | List port mappings for a container. | 245 | [podman-ps(1)](podman-ps.1.md) | Prints out information about containers. | 246 | [podman-pull(1)](podman-pull.1.md) | Pull an image from a registry. | 247 | [podman-push(1)](podman-push.1.md) | Push an image from local storage to elsewhere. | 248 | [podman-restart(1)](podman-restart.1.md) | Restart one or more containers. | 249 | [podman-rm(1)](podman-rm.1.md) | Remove one or more containers. | 250 | [podman-rmi(1)](podman-rmi.1.md) | Removes one or more locally stored images. | 251 | [podman-run(1)](podman-run.1.md) | Run a command in a new container. | 252 | [podman-save(1)](podman-save.1.md) | Save image(s) to an archive. | 253 | [podman-search(1)](podman-search.1.md) | Search a registry for an image. | 254 | [podman-start(1)](podman-start.1.md) | Start one or more containers. | 255 | [podman-stats(1)](podman-stats.1.md) | Display a live stream of one or more container's resource usage statistics. | 256 | [podman-stop(1)](podman-stop.1.md) | Stop one or more running containers. | 257 | [podman-system(1)](podman-system.1.md) | Manage podman. | 258 | [podman-tag(1)](podman-tag.1.md) | Add an additional name to a local image. | 259 | [podman-top(1)](podman-top.1.md) | Display the running processes of a container. | 260 | [podman-unmount(1)](podman-unmount.1.md) | Unmount a working container's root filesystem. | 261 | [podman-unpause(1)](podman-unpause.1.md) | Unpause one or more containers. | 262 | [podman-unshare(1)](podman-unshare.1.md) | Run a command inside of a modified user namespace. | 263 | [podman-untag(1)](podman-untag.1.md) | Removes one or more names from a locally-stored image. | 264 | [podman-version(1)](podman-version.1.md) | Display the Podman version information. | 265 | [podman-volume(1)](podman-volume.1.md) | Simple management tool for volumes. | 266 | [podman-wait(1)](podman-wait.1.md) | Wait on one or more containers to stop and print their exit codes. | 267 268 ## CONFIGURATION FILES 269 270 **containers.conf** (`/usr/share/containers/containers.conf`, `/etc/containers/containers.conf`, `$HOME/.config/containers/containers.conf`) 271 272 Podman has builtin defaults for command line options. These defaults can be overridden using the containers.conf configuration files. 273 274 Distributions ship the `/usr/share/containers/containers.conf` file with their default settings. Administrators can override fields in this file by creating the `/etc/containers/containers.conf` file. Users can further modify defaults by creating the `$HOME/.config/containers/containers.conf` file. Podman merges its builtin defaults with the specified fields from these files, if they exist. Fields specified in the users file override the administrator's file, which overrides the distribution's file, which override the built-in defaults. 275 276 Podman uses builtin defaults if no containers.conf file is found. 277 278 **mounts.conf** (`/usr/share/containers/mounts.conf`) 279 280 The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when executing the `podman run` or `podman start` commands. Administrators can override the defaults file by creating `/etc/containers/mounts.conf`. 281 282 When Podman runs in rootless mode, the file `$HOME/.config/containers/mounts.conf` will override the default if it exists. Please refer to containers-mounts.conf(5) for further details. 283 284 **policy.json** (`/etc/containers/policy.json`) 285 286 Signature verification policy files are used to specify policy, e.g. trusted keys, applicable when deciding whether to accept an image, or individual signatures of that image, as valid. 287 288 **registries.conf** (`/etc/containers/registries.conf`, `$HOME/.config/containers/registries.conf`) 289 290 registries.conf is the configuration file which specifies which container registries should be consulted when completing image names which do not include a registry or domain portion. 291 292 Non root users of Podman can create the `$HOME/.config/containers/registries.conf` file to be used instead of the system defaults. 293 294 **storage.conf** (`/etc/containers/storage.conf`, `$HOME/.config/contaners/storage.conf`) 295 296 storage.conf is the storage configuration file for all tools using containers/storage 297 298 The storage configuration file specifies all of the available container storage options for tools using shared container storage. 299 300 When Podman runs in rootless mode, the file `$HOME/.config/containers/storage.conf` is used instead of the system defaults. 301 302 ## Rootless mode 303 Podman can also be used as non-root user. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in /etc/subuid and /etc/subgid. 304 305 Containers created by a non-root user are not visible to other users and are not seen or managed by Podman running as root. 306 307 It is required to have multiple uids/gids set for an user. Be sure the user is present in the files `/etc/subuid` and `/etc/subgid`. 308 309 If you have a recent version of usermod, you can execute the following 310 commands to add the ranges to the files 311 312 $ sudo usermod --add-subuids 10000-75535 USERNAME 313 $ sudo usermod --add-subgids 10000-75535 USERNAME 314 315 Or just add the content manually. 316 317 $ echo USERNAME:10000:65536 >> /etc/subuid 318 $ echo USERNAME:10000:65536 >> /etc/subgid 319 320 See the `subuid(5)` and `subgid(5)` man pages for more information. 321 322 Images are pulled under `XDG_DATA_HOME` when specified, otherwise in the home directory of the user under `.local/share/containers/storage`. 323 324 Currently the slirp4netns package is required to be installed to create a network device, otherwise rootless containers need to run in the network namespace of the host. 325 326 ### **NOTE:** Unsupported file systems in rootless mode 327 328 The Overlay file system (OverlayFS) is not supported in rootless mode. The fuse-overlayfs package is a tool that provides the functionality of OverlayFS in user namespace that allows mounting file systems in rootless environments. It is recommended to install the fuse-overlayfs package and to enable it by adding `mount_program = "/usr/bin/fuse-overlayfs"` under `[storage.options]` in the `$HOME/.config/containers/storage.conf` file. 329 330 The Network File System (NFS) and other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are not supported when running in rootless mode as these file systems do not understand user namespace. However, rootless Podman can make use of an NFS Homedir by modifying the `$HOME/.config/containers/storage.conf` to have the `graphroot` option point to a directory stored on local (Non NFS) storage. 331 332 For more information, please refer to the [Podman Troubleshooting Page](https://github.com/containers/podman/blob/master/troubleshooting.md). 333 334 ## SEE ALSO 335 `containers-mounts.conf(5)`, `containers-registries.conf(5)`, `containers-storage.conf(5)`, `buildah(1)`, `containers.conf(5)`, `oci-hooks(5)`, `containers-policy.json(5)`, `crun(8)`, `runc(8)`, `subuid(5)`, `subgid(5)`, `slirp4netns(1)` 336 337 ## HISTORY 338 Dec 2016, Originally compiled by Dan Walsh <dwalsh@redhat.com>