Environment variable list for the container process, used for passing
environment variables to the container.
**env_host**=false
Pass all host environment variables into the container.
**http_proxy**=true
Default proxy environment variables will be passed into the container.
The environment variables passed in include:
`http_proxy`, `https_proxy`, `ftp_proxy`, `no_proxy`, and the upper case
versions of these. The `no_proxy` option is needed when host system uses a proxy
but container should not use proxy. Proxy environment variables specified for
the container in any other way will override the values passed from the host.
**init**=false
Run an init inside the container that forwards signals and reaps processes.
**init_path**="/usr/libexec/podman/catatonit"
Path to the container-init binary, which forwards signals and reaps processes
within containers. Note that the container-init binary will only be used when
the `--init` for podman-create and podman-run is set.
**ipcns**="private"
Default way to to create a IPC namespace for the container.
Options are:
`private` Create private IPC Namespace for the container.
`host` Share host IPC Namespace with the container.
**keyring**=true
Indicates whether the container engines create a kernel keyring for use within
the container.
**label**=true
Indicates whether the container engine uses MAC(SELinux) container separation via labeling. This option is ignored on disabled systems.
**log_driver**="k8s-file"
Logging driver for the container. Available options: `k8s-file` and `journald`.
**log_size_max**=-1
Maximum size allowed for the container's log file. Negative numbers indicate
that no size limit is imposed. If it is positive, it must be >= 8192 to
match/exceed conmon's read buffer. The file is truncated and re-opened so the
limit is never exceeded.
**log_tag**=""
Default format tag for container log messages. This is useful for creating a specific tag for container log messages. Container log messages default to using the truncated container ID as a tag.
**netns**="private"
Default way to to create a NET namespace for the container.
Options are:
`private` Create private NET Namespace for the container.
`host` Share host NET Namespace with the container.
`none` Containers do not use the network.
**no_hosts**=false
Create /etc/hosts for the container. By default, container engines manage
/etc/hosts, automatically adding the container's own IP address.
**pidns**="private"
Default way to to create a PID namespace for the container.
Options are:
`private` Create private PID Namespace for the container.
`host` Share host PID Namespace with the container.
**pids_limit**=1024
Maximum number of processes allowed in a container. 0 indicates that no limit
is imposed.
**prepare_volume_on_create**=false
Copy the content from the underlying image into the newly created volume when the container is created instead of when it is started. If `false`, the container engine will not copy the content until the container is started. Setting it to `true` may have negative performance implications.
**rootless_networking**="slirp4netns"
Set type of networking rootless containers should use. Valid options are `slirp4netns`
Path to the OCI hooks directories for automatically executed hooks.
**image_default_format**="oci"|"v2s2"|"v2s1"
Manifest Type (oci, v2s2, or v2s1) to use when pulling, pushing, building
container images. By default images pulled and pushed match the format of the
source image. Building/committing defaults to OCI.
Note: **image_build_format** is deprecated.
**image_default_transport**="docker://"
Default transport method for pulling and pushing images.
**image_parallel_copies**=0
Maximum number of image layers to be copied (pulled/pushed) simultaneously.
Not setting this field will fall back to containers/image defaults. (6)
**infra_command**="/pause"
Command to run the infra container.
**infra_image**="k8s.gcr.io/pause:3.4.1"
Infra (pause) container image name for pod infra containers. When running a
pod, we start a `pause` process in a container to hold open the namespaces
associated with the pod. This container does nothing other then sleep,
reserving the pods resources for the lifetime of the pod.
**lock_type**="shm"
Specify the locking mechanism to use; valid values are "shm" and "file".
Change the default only if you are sure of what you are doing, in general
"file" is useful only on platforms where cgo is not available for using the
faster "shm" lock type. You may need to run "podman system renumber" after you
change the lock type.
**machine_enabled**=false
Indicates if Podman is running inside a VM via Podman Machine.
Podman uses this value to do extra setup around networking from the
container inside the VM to to host.
**multi_image_archive**=false
Allows for creating archives (e.g., tarballs) with more than one image. Some container engines, such as Podman, interpret additional arguments as tags for one image and hence do not store more than one image. The default behavior can be altered with this option.
**namespace**=""
Default engine namespace. If the engine is joined to a namespace, it will see
only containers and pods that were created in the same namespace, and will
create new containers and pods in that namespace. The default namespace is "",
which corresponds to no namespace. When no namespace is set, all containers
Whether to use chroot instead of pivot_root in the runtime.
**num_locks**=2048
Number of locks available for containers and pods. Each created container or
pod consumes one lock. The default number available is 2048. If this is
changed, a lock renumbering must be performed, using the
`podman system renumber` command.
**pull_policy**="always"|"missing"|"never"
Pull image before running or creating a container. The default is **missing**.
- **missing**: attempt to pull the latest image from the registries listed in registries.conf if a local image does not exist. Raise an error if the image is not in any listed registry and is not present locally.
- **always**: pull the image from the first registry it is found in as listed in registries.conf. Raise an error if not found in the registries, even if the image is present locally.
- **never**: do not pull the image from the registry, use only the local version. Raise an error if the image is not present locally.
**remote** = false
Indicates whether the application should be running in remote mode. This flag modifies the
--remote option on container engines. Setting the flag to true will default `podman --remote=true` for access to the remote Podman service.
**runtime**=""
Default OCI specific runtime in runtimes that will be used by default. Must
refer to a member of the runtimes table. Default runtime will be searched for
on the system using the priority: "crun", "runc", "kata".
