This update for podman fixes the following issues:
Security issue fixed:
Non-security issues fixed:
add dependency to timezone package or podman fails to build a container (bsc#1178122)
Install new auto-update system units
podman info
command now includes the cgroup manager
Podman is using.podman image mount
, has been added. This
allows for an image to be mounted, read-only, to inspect its
contents without creating a container from it [#1433].podman save
and podman load
commands can now create
and load archives containing multiple images [#2669].podman network
commands,
and rootless containers can now be joined to networks.podman build
on ADD
and COPY
instructions has been greatly improved, especially when a
.dockerignore
is present.podman run
and podman create
commands now support a
new mode for the --cgroups
option, --cgroups=split
.
Podman will create two cgroups under the cgroup it was
launched in, one for the container and one for Conmon. This
mode is useful for running Podman in a systemd unit, as it
ensures that all processes are retained in systemd's cgroup
hierarchy [#6400].podman run
and podman create
commands can now specify
options to slirp4netns by using the --network
option as
follows: --net slirp4netns:opt1,opt2
. This allows for,
among other things, switching the port forwarder used by
slirp4netns away from rootlessport.podman ps
command now features a new option,
--storage
, to show containers from Buildah, CRI-O and other
applications.podman run
and podman create
commands now feature a
--sdnotify
option to control the behavior of systemd's
sdnotify with containers, enabling improved support for
Podman in Type=notify
units.podman run
command now features a --preserve-fds
opton to pass file descriptors from the host into the
container [#6458].podman run
and podman create
commands can now create
overlay volume mounts, by adding the :O
option to a bind
mount (e.g. -v /test:/test:O
). Overlay volume mounts will
mount a directory into a container from the host and allow
changes to it, but not write those changes back to the
directory on the host.podman play kube
command now supports the Socket
HostPath type [#7112].podman play kube
command now supports read-only mounts.podman play kube
command now supports setting labels on
pods from Kubernetes metadata labels.podman play kube
command now supports setting container
restart policy [#7656].podman play kube
command now properly handles
HostAlias
entries.podman generate kube
command now adds entries to
/etc/hosts
from --host-add
generated YAML as HostAlias
entries.podman play kube
and podman generate kube
commands
now properly support shareProcessNamespace
to share the PID
namespace in pods.podman volume ls
command now supports the dangling
filter to identify volumes that are dangling (not attached to
any container).podman run
and podman create
commands now feature a
--umask
option to set the umask of the created container.podman create
and podman run
commands now feature a
--tz
option to set the timezone within the container [#5128].containers.conf
configuration file.--mount
option of podman run
and podman create
now
supports a new mount type, type=devpts
, to add a devpts
mount to the container. This is useful for containers that
want to mount /dev/
from the host into the container, but
still create a terminal.--security-opt
flag to podman run
and podman create
now supports a new option, proc-opts
, to specify options
for the container's /proc
filesystem.crun
OCI runtime now supports a new option
to podman run
and podman create
, --cgroup-conf
, which
allows for advanced configuration of cgroups on cgroups v2
systems.podman create
and podman run
commands now support a
--override-variant
option, to override the architecture
variant of the image that will be pulled and ran.--runtime-flags
, which allows for setting flags to use when
the OCI runtime is called.podman manifest add
command now supports the
--cert-dir
, --auth-file
, --creds
, and --tls-verify
options.podman exec
command would previously print error
messages (e.g. exec session exited with non-zero exit code
-1
) when the command run exited with a non-0 exit code. It
no longer does this. The podman exec
command will still
exit with the same exit code as the command run in the
container did./run
. This was previously limited to
65k in size and mounted noexec
, but is now unlimited size
and mounted exec
.podman system reset
command no longer removes
configuration files for rootless Podman.last
parameter to the Libpod container list endpoint
now has an alias, limit
[#6413].filter
query parameter [#6797].noTrunc
option to the Libpod image search endpoint.This update was imported from the SUSE:SLE-15-SP1:Update update project.