github.com/containers/podman/v4@v4.9.4/README.md (about)

     1  ![PODMAN logo](https://raw.githubusercontent.com/containers/common/main/logos/podman-logo-full-vert.png)
     2  
     3  # Podman: A tool for managing OCI containers and pods
     4  ![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)
     5  ![GitHub release (latest SemVer)](https://img.shields.io/github/v/release/containers/podman)
     6  [![Go Report Card](https://goreportcard.com/badge/github.com/containers/libpod)](https://goreportcard.com/report/github.com/containers/libpod)
     7  
     8  <br/>
     9  
    10  Podman (the POD MANager) is a tool for managing containers and images, volumes mounted into those containers, and pods made from groups of containers.
    11  Podman runs containers on Linux, but can also be used on Mac and Windows systems using a Podman-managed virtual machine.
    12  Podman is based on libpod, a library for container lifecycle management that is also contained in this repository. The libpod library provides APIs for managing containers, pods, container images, and volumes.
    13  
    14  
    15  All releases are GPG signed. Public keys of members of the team approved to make releases are located [here](https://github.com/containers/release-keys/tree/main/podman).
    16  
    17  * Continuous Integration:
    18    * [![Build Status](https://api.cirrus-ci.com/github/containers/podman.svg)](https://cirrus-ci.com/github/containers/podman/master)
    19    * [GoDoc: ![GoDoc](https://godoc.org/github.com/containers/podman/libpod?status.svg)](https://godoc.org/github.com/containers/podman/libpod)
    20    * [Downloads](DOWNLOADS.md)
    21  
    22  ## Overview and scope
    23  
    24  At a high level, the scope of Podman and libpod is the following:
    25  
    26  * Support for multiple container image formats, including OCI and Docker images.
    27  * Full management of those images, including pulling from various sources (including trust and verification), creating (built via Containerfile or Dockerfile or committed from a container), and pushing to registries and other storage backends.
    28  * Full management of container lifecycle, including creation (both from an image and from an exploded root filesystem), running, checkpointing and restoring (via CRIU), and removal.
    29  * Full management of container networking, using Netavark.
    30  * Support for pods, groups of containers that share resources and are managed together.
    31  * Support for running containers and pods without root or other elevated privileges.
    32  * Resource isolation of containers and pods.
    33  * Support for a Docker-compatible CLI interface, which can both run containers locally and on remote systems.
    34  * No manager daemon, for improved security and lower resource utilization at idle.
    35  * Support for a REST API providing both a Docker-compatible interface and an improved interface exposing advanced Podman functionality.
    36  * Support for running on Windows and Mac via virtual machines run by `podman machine`.
    37  
    38  ## Roadmap
    39  
    40  1. A fully-featured GUI frontend for `podman machine`
    41  1. Further improvements to `podman generate kube` and `podman play kube`
    42  1. Improvements to Pods, including the addition of pod-level resource limits
    43  
    44  ## Communications
    45  
    46  If you think you've identified a security issue in the project, please *DO NOT* report the issue publicly via the GitHub issue tracker, mailing list, or IRC.
    47  Instead, send an email with as many details as possible to `security@lists.podman.io`. This is a private mailing list for the core maintainers.
    48  
    49  For general questions and discussion, please use Podman's
    50  [channels](https://podman.io/community/#slack-irc-matrix-and-discord).
    51  
    52  For discussions around issues/bugs and features, you can use the GitHub
    53  [issues](https://github.com/containers/podman/issues)
    54  and
    55  [PRs](https://github.com/containers/podman/pulls)
    56  tracking system.
    57  
    58  There is also a [mailing list](https://lists.podman.io/archives/) at `lists.podman.io`.
    59  You can subscribe by sending a message to `podman-join@lists.podman.io` with the subject `subscribe`.
    60  
    61  ## Rootless
    62  Podman can be easily run as a normal user, without requiring a setuid binary.
    63  When run without root, Podman containers use user namespaces to set root in the container to the user running Podman.
    64  Rootless Podman runs locked-down containers with no privileges that the user running the container does not have.
    65  Some of these restrictions can be lifted (via `--privileged`, for example), but rootless containers will never have more privileges than the user that launched them.
    66  If you run Podman as your user and mount in `/etc/passwd` from the host, you still won't be able to change it, since your user doesn't have permission to do so.
    67  
    68  Almost all normal Podman functionality is available, though there are some [shortcomings](https://github.com/containers/podman/blob/main/rootless.md).
    69  Any recent Podman release should be able to run rootless without any additional configuration, though your operating system may require some additional configuration detailed in the [install guide](https://podman.io/getting-started/installation).
    70  
    71  A little configuration by an administrator is required before rootless Podman can be used, the necessary setup is documented [here](https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md).
    72  
    73  ## Podman Desktop
    74  
    75  [Podman Desktop](https://podman-desktop.io/) is a new project under the container organization built to help the developers working with containers from their local environment with a desktop UI. Podman Desktop is still in its early days, but already provides capabilities to list your images, interact with containers (access logs, get a terminal), connect to registries (pull private images, push your images) and configure podman settings (proxies). The project develops on [Github](https://github.com/containers/podman-desktop) and contributors are welcome.
    76  
    77  ## Out of scope
    78  
    79  * Specialized signing and pushing of images to various storage backends.
    80    See [Skopeo](https://github.com/containers/skopeo/) for those tasks.
    81  * Support for the Kubernetes CRI interface for container management.
    82    The [CRI-O](https://github.com/cri-o/cri-o) daemon specializes in that.
    83  
    84  ## OCI Projects Plans
    85  
    86  Podman uses OCI projects and best of breed libraries for different aspects:
    87  - Runtime: We use the [OCI runtime tools](https://github.com/opencontainers/runtime-tools) to generate OCI runtime configurations that can be used with any OCI-compliant runtime, like [crun](https://github.com/containers/crun/) and [runc](https://github.com/opencontainers/runc/).
    88  - Images: Image management uses the [containers/image](https://github.com/containers/image) library.
    89  - Storage: Container and image storage is managed by [containers/storage](https://github.com/containers/storage).
    90  - Networking: Networking support through use of [Netavark](https://github.com/containers/netavark) and [Aardvark](https://github.com/containers/aardvark-dns).  Rootless networking is handled via [slirp4netns](https://github.com/rootless-containers/slirp4netns).
    91  - Builds: Builds are supported via [Buildah](https://github.com/containers/buildah).
    92  - Conmon: [Conmon](https://github.com/containers/conmon) is a tool for monitoring OCI runtimes, used by both Podman and CRI-O.
    93  - Seccomp: A unified [Seccomp](https://github.com/containers/common/blob/main/pkg/seccomp/seccomp.json) policy for Podman, Buildah, and CRI-O.
    94  
    95  ## Podman Information for Developers
    96  
    97  For blogs, release announcements and more, please checkout the [podman.io](https://podman.io) website!
    98  
    99  **[Installation notes](install.md)**
   100  Information on how to install Podman in your environment.
   101  
   102  **[OCI Hooks Support](https://github.com/containers/common/blob/main/pkg/hooks/README.md)**
   103  Information on how Podman configures [OCI Hooks][spec-hooks] to run when launching a container.
   104  
   105  **[Podman API](https://docs.podman.io/en/latest/_static/api.html)**
   106  Documentation on the Podman REST API.
   107  
   108  **[Podman Commands](https://podman.readthedocs.io/en/latest/Commands.html)**
   109  A list of the Podman commands with links to their man pages and in many cases videos
   110  showing the commands in use.
   111  
   112  **[Podman Troubleshooting Guide](troubleshooting.md)**
   113  A list of common issues and solutions for Podman.
   114  
   115  **[Podman Usage Transfer](transfer.md)**
   116  Useful information for ops and dev transfer as it relates to infrastructure that utilizes Podman.  This page
   117  includes tables showing Docker commands and their Podman equivalent commands.
   118  
   119  **[Tutorials](docs/tutorials)**
   120  Tutorials on using Podman.
   121  
   122  **[Remote Client](https://github.com/containers/podman/blob/main/docs/tutorials/remote_client.md)**
   123  A brief how-to on using the Podman remote client.
   124  
   125  **[Basic Setup and Use of Podman in a Rootless environment](https://github.com/containers/podman/blob/main/docs/tutorials/rootless_tutorial.md)**
   126  A tutorial showing the setup and configuration necessary to run Rootless Podman.
   127  
   128  **[Release Notes](RELEASE_NOTES.md)**
   129  Release notes for recent Podman versions.
   130  
   131  **[Contributing](CONTRIBUTING.md)**
   132  Information about contributing to this project.
   133  
   134  [spec-hooks]: https://github.com/opencontainers/runtime-spec/blob/v1.0.2/config.md#posix-platform-hooks
   135  
   136  ## Buildah and Podman relationship
   137  
   138  Buildah and Podman are two complementary open-source projects that are
   139  available on most Linux platforms and both projects reside at
   140  [GitHub.com](https://github.com) with Buildah
   141  [here](https://github.com/containers/buildah) and Podman
   142  [here](https://github.com/containers/podman).  Both, Buildah and Podman are
   143  command line tools that work on Open Container Initiative (OCI) images and
   144  containers.  The two projects differentiate in their specialization.
   145  
   146  Buildah specializes in building OCI images.  Buildah's commands replicate all
   147  of the commands that are found in a Dockerfile.  This allows building images
   148  with and without Dockerfiles while not requiring any root privileges.
   149  Buildah’s ultimate goal is to provide a lower-level coreutils interface to
   150  build images.  The flexibility of building images without Dockerfiles allows
   151  for the integration of other scripting languages into the build process.
   152  Buildah follows a simple fork-exec model and does not run as a daemon
   153  but it is based on a comprehensive API in golang, which can be vendored
   154  into other tools.
   155  
   156  Podman specializes in all of the commands and functions that help you to maintain and modify
   157  OCI images, such as pulling and tagging.  It also allows you to create, run, and maintain those containers
   158  created from those images.  For building container images via Dockerfiles, Podman uses Buildah's
   159  golang API and can be installed independently from Buildah.
   160  
   161  A major difference between Podman and Buildah is their concept of a container.  Podman
   162  allows users to create "traditional containers" where the intent of these containers is
   163  to be long lived.  While Buildah containers are really just created to allow content
   164  to be added back to the container image.  An easy way to think of it is the
   165  `buildah run` command emulates the RUN command in a Dockerfile while the `podman run`
   166  command emulates the `docker run` command in functionality.  Because of this and their underlying
   167  storage differences, you can not see Podman containers from within Buildah or vice versa.
   168  
   169  In short, Buildah is an efficient way to create OCI images while Podman allows
   170  you to manage and maintain those images and containers in a production environment using
   171  familiar container cli commands.  For more details, see the
   172  [Container Tools Guide](https://github.com/containers/buildah/tree/main/docs/containertools).
   173  
   174  ## Podman Hello
   175  ```
   176  $ podman run quay.io/podman/hello
   177  Trying to pull quay.io/podman/hello:latest...
   178  Getting image source signatures
   179  Copying blob a6b3126f3807 done
   180  Copying config 25c667d086 done
   181  Writing manifest to image destination
   182  Storing signatures
   183  !... Hello Podman World ...!
   184  
   185           .--"--.
   186         / -     - \
   187        / (O)   (O) \
   188     ~~~| -=(,Y,)=- |
   189      .---. /`  \   |~~
   190   ~/  o  o \~~~~.----. ~~
   191    | =(X)= |~  / (O (O) \
   192     ~~~~~~~  ~| =(Y_)=-  |
   193    ~~~~    ~~~|   U      |~~
   194  
   195  Project:   https://github.com/containers/podman
   196  Website:   https://podman.io
   197  Documents: https://docs.podman.io
   198  Twitter:   @Podman_io
   199  ```
   200  
   201  ## Podman Former API (Varlink)
   202  Podman formerly offered a Varlink-based API for remote management of containers. However, this API
   203  was replaced by the REST API. Varlink support has been removed as of the 3.0 release.
   204  For more details, you can see [this blog](https://podman.io/blogs/2020/01/17/podman-new-api.html).