Allow s390x to use clone syscall in seccomp.json
Add support for containers.conf and man page
This commit is contained in:
parent
9113b7eb2f
commit
c2ef798d7f
366
containers.conf
Normal file
366
containers.conf
Normal file
@ -0,0 +1,366 @@
|
|||||||
|
# The containers configuration file specifies all of the available configuration
|
||||||
|
# command-line options/flags for container runtime tools like Podman & Buildah,
|
||||||
|
# but in a TOML format that can be easily modified and versioned.
|
||||||
|
|
||||||
|
# Please refer to containers.conf(5) for details of all configuration options.
|
||||||
|
# Not all container tools implement all of the options.
|
||||||
|
# All of the options have hard coded defaults and these options will override
|
||||||
|
# the built in defaults. Users can then override these options via the command
|
||||||
|
# line. Container engines will read containers.conf files in up to three
|
||||||
|
# locations in the following order:
|
||||||
|
# 1. /usr/share/containers/containers.conf
|
||||||
|
# 2. /etc/containers/containers.conf
|
||||||
|
# 3. $HOME/.config/containers/containers.conf (Rootless containers ONLY)
|
||||||
|
# Items specified in the latter containers.conf, if they exist, override the
|
||||||
|
# previous containers.conf settings, or the default settings.
|
||||||
|
|
||||||
|
[containers]
|
||||||
|
|
||||||
|
# List of additional devices. Specified as
|
||||||
|
# "<device-on-host>:<device-on-container>:<permissions>", for example:
|
||||||
|
# "/dev/sdc:/dev/xvdc:rwm".
|
||||||
|
# If it is empty or commented out, only the default devices will be used
|
||||||
|
#
|
||||||
|
# additional_devices = []
|
||||||
|
|
||||||
|
# List of additional volumes. Specified as
|
||||||
|
# "<directory-on-host>:<directory-in-container>:<options>", for example:
|
||||||
|
# "/db:/var/lib/db:ro".
|
||||||
|
# If it is empty or commented out, no volumes will be added
|
||||||
|
#
|
||||||
|
# additional_volumes = []
|
||||||
|
|
||||||
|
# Used to change the name of the default AppArmor profile of container engines.
|
||||||
|
#
|
||||||
|
# apparmor_profile = "container-default"
|
||||||
|
|
||||||
|
# Default way to to create a cgroup namespace for the container
|
||||||
|
# Options are:
|
||||||
|
# `private` Create private Cgroup Namespace for the container.
|
||||||
|
# `host` Share host Cgroup Namespace with the container.
|
||||||
|
#
|
||||||
|
# cgroupns = "private"
|
||||||
|
|
||||||
|
# Cgroup management implementation used for the runtime.
|
||||||
|
# Valid options “systemd” or “cgroupfs”
|
||||||
|
#
|
||||||
|
# cgroup_manager = "systemd"
|
||||||
|
|
||||||
|
# List of default capabilities for containers. If it is empty or commented out,
|
||||||
|
# the default capabilities defined in the container engine will be added.
|
||||||
|
#
|
||||||
|
# default_capabilities = [
|
||||||
|
# "AUDIT_WRITE",
|
||||||
|
# "CHOWN",
|
||||||
|
# "DAC_OVERRIDE",
|
||||||
|
# "FOWNER",
|
||||||
|
# "FSETID",
|
||||||
|
# "KILL",
|
||||||
|
# "MKNOD",
|
||||||
|
# "NET_BIND_SERVICE",
|
||||||
|
# "NET_RAW",
|
||||||
|
# "SETGID",
|
||||||
|
# "SETPCAP",
|
||||||
|
# "SETUID",
|
||||||
|
# "SYS_CHROOT",
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# A list of sysctls to be set in containers by default,
|
||||||
|
# specified as "name=value",
|
||||||
|
# for example:"net.ipv4.ping_group_range = 0 1000".
|
||||||
|
#
|
||||||
|
# default_sysctls = [
|
||||||
|
# "net.ipv4.ping_group_range=0 1000",
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# A list of ulimits to be set in containers by default, specified as
|
||||||
|
# "<ulimit name>=<soft limit>:<hard limit>", for example:
|
||||||
|
# "nofile=1024:2048"
|
||||||
|
# See setrlimit(2) for a list of resource names.
|
||||||
|
# Any limit not specified here will be inherited from the process launching the
|
||||||
|
# container engine.
|
||||||
|
# Ulimits has limits for non privileged container engines.
|
||||||
|
#
|
||||||
|
# default_ulimits = [
|
||||||
|
# “nofile”=”1280:2560”,
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# List of default DNS options to be added to /etc/resolv.conf inside of the container.
|
||||||
|
#
|
||||||
|
# dns_options = []
|
||||||
|
|
||||||
|
# List of default DNS search domains to be added to /etc/resolv.conf inside of the container.
|
||||||
|
#
|
||||||
|
# dns_searches = []
|
||||||
|
|
||||||
|
# Set default DNS servers.
|
||||||
|
# This option can be used to override the DNS configuration passed to the
|
||||||
|
# container. The special value “none” can be specified to disable creation of
|
||||||
|
# /etc/resolv.conf in the container.
|
||||||
|
# The /etc/resolv.conf file in the image will be used without changes.
|
||||||
|
#
|
||||||
|
# dns_servers = []
|
||||||
|
|
||||||
|
# Environment variable list for the conmon process; used for passing necessary
|
||||||
|
# environment variables to conmon or the runtime.
|
||||||
|
#
|
||||||
|
# env = [
|
||||||
|
# "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# Pass all host environment variables into the container.
|
||||||
|
#
|
||||||
|
# env_host = false
|
||||||
|
|
||||||
|
# Path to OCI hooks directories for automatically executed hooks.
|
||||||
|
#
|
||||||
|
# hooks_dir = [
|
||||||
|
# “/usr/share/containers/oci/hooks.d”,
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# Default proxy environment variables passed into the container.
|
||||||
|
# The environment variables passed in include:
|
||||||
|
# http_proxy, https_proxy, ftp_proxy, no_proxy, and the upper case versions of
|
||||||
|
# these. This option is needed when host system uses a proxy but container
|
||||||
|
# should not use proxy. Proxy environment variables specified for the container
|
||||||
|
# in any other way will override the values passed from the host.
|
||||||
|
#
|
||||||
|
# http_proxy = true
|
||||||
|
|
||||||
|
# Run an init inside the container that forwards signals and reaps processes.
|
||||||
|
#
|
||||||
|
# init = false
|
||||||
|
|
||||||
|
# Container init binary, if init=true, this is the init binary to be used for containers.
|
||||||
|
#
|
||||||
|
# init_path = "/usr/libexec/podman/catatonit"
|
||||||
|
|
||||||
|
# Default way to to create an IPC namespace (POSIX SysV IPC) for the container
|
||||||
|
# Options are:
|
||||||
|
# `private` Create private IPC Namespace for the container.
|
||||||
|
# `host` Share host IPC Namespace with the container.
|
||||||
|
#
|
||||||
|
# ipcns = "private"
|
||||||
|
|
||||||
|
# container engines use container separation using MAC(SELinux) labeling.
|
||||||
|
# Flag is ignored on label disabled systems.
|
||||||
|
#
|
||||||
|
# label = true
|
||||||
|
|
||||||
|
# Logging driver for the container. Available options: k8s-file and journald.
|
||||||
|
#
|
||||||
|
# log_driver = "k8s-file"
|
||||||
|
|
||||||
|
# Maximum size allowed for the container log file. Negative numbers indicate
|
||||||
|
# that no size limit is imposed. If positive, it must be >= 8192 to match or
|
||||||
|
# exceed conmon's read buffer. The file is truncated and re-opened so the
|
||||||
|
# limit is never exceeded.
|
||||||
|
#
|
||||||
|
# log_size_max = -1
|
||||||
|
|
||||||
|
# Default way to to create a Network namespace for the container
|
||||||
|
# Options are:
|
||||||
|
# `private` Create private Network Namespace for the container.
|
||||||
|
# `host` Share host Network Namespace with the container.
|
||||||
|
# `none` Containers do not use the network
|
||||||
|
#
|
||||||
|
# netns = "private"
|
||||||
|
|
||||||
|
# Create /etc/hosts for the container. By default, container engines manage
|
||||||
|
# /etc/hosts, automatically adding the container's own IP address.
|
||||||
|
#
|
||||||
|
# no_hosts = false
|
||||||
|
|
||||||
|
# Maximum number of processes allowed in a container.
|
||||||
|
#
|
||||||
|
# pids_limit = 2048
|
||||||
|
|
||||||
|
# Default way to to create a PID namespace for the container
|
||||||
|
# Options are:
|
||||||
|
# `private` Create private PID Namespace for the container.
|
||||||
|
# `host` Share host PID Namespace with the container.
|
||||||
|
#
|
||||||
|
# pidns = "private"
|
||||||
|
|
||||||
|
# Path to the seccomp.json profile which is used as the default seccomp profile
|
||||||
|
# for the runtime.
|
||||||
|
#
|
||||||
|
# seccomp_profile = "/usr/share/containers/seccomp.json"
|
||||||
|
|
||||||
|
# Size of /dev/shm. Specified as <number><unit>.
|
||||||
|
# Unit is optional, values:
|
||||||
|
# b (bytes), k (kilobytes), m (megabytes), or g (gigabytes).
|
||||||
|
# If the unit is omitted, the system uses bytes.
|
||||||
|
#
|
||||||
|
# shm_size = "65536k"
|
||||||
|
|
||||||
|
# Default way to to create a UTS namespace for the container
|
||||||
|
# Options are:
|
||||||
|
# `private` Create private UTS Namespace for the container.
|
||||||
|
# `host` Share host UTS Namespace with the container.
|
||||||
|
#
|
||||||
|
# utsns = "private"
|
||||||
|
|
||||||
|
# Default way to to create a User namespace for the container
|
||||||
|
# Options are:
|
||||||
|
# `auto` Create unique User Namespace for the container.
|
||||||
|
# `host` Share host User Namespace with the container.
|
||||||
|
#
|
||||||
|
# userns = "host"
|
||||||
|
|
||||||
|
# Number of UIDs to allocate for the automatic container creation.
|
||||||
|
# UIDs are allocated from the “container” UIDs listed in
|
||||||
|
# /etc/subuid & /etc/subgid
|
||||||
|
#
|
||||||
|
# userns_size=65536
|
||||||
|
|
||||||
|
# The network table contains settings pertaining to the management of
|
||||||
|
# CNI plugins.
|
||||||
|
|
||||||
|
[network]
|
||||||
|
|
||||||
|
# Path to directory where CNI plugin binaries are located.
|
||||||
|
#
|
||||||
|
# cni_plugin_dirs = ["/usr/libexec/cni"]
|
||||||
|
|
||||||
|
# Path to the directory where CNI configuration files are located.
|
||||||
|
#
|
||||||
|
# network_config_dir = "/etc/cni/net.d/"
|
||||||
|
|
||||||
|
[libpod]
|
||||||
|
|
||||||
|
# Environment variables to pass into conmon
|
||||||
|
#
|
||||||
|
# conmon_env_vars = [
|
||||||
|
# "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# Paths to look for the conmon container manager binary
|
||||||
|
#
|
||||||
|
# conmon_path = [
|
||||||
|
# "/usr/libexec/podman/conmon",
|
||||||
|
# "/usr/local/libexec/podman/conmon",
|
||||||
|
# "/usr/local/lib/podman/conmon",
|
||||||
|
# "/usr/bin/conmon",
|
||||||
|
# "/usr/sbin/conmon",
|
||||||
|
# "/usr/local/bin/conmon",
|
||||||
|
# "/usr/local/sbin/conmon"
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# Specify the keys sequence used to detach a container.
|
||||||
|
# Format is a single character [a-Z] or a comma separated sequence of
|
||||||
|
# `ctrl-<value>`, where `<value>` is one of:
|
||||||
|
# `a-z`, `@`, `^`, `[`, `\`, `]`, `^` or `_`
|
||||||
|
#
|
||||||
|
# detach_keys = "ctrl-p,ctrl-q"
|
||||||
|
|
||||||
|
# Determines whether libpod will reserve ports on the host when they are
|
||||||
|
# forwarded to containers. When enabled, when ports are forwarded to containers,
|
||||||
|
# ports are held open by as long as the container is running, ensuring that
|
||||||
|
# they cannot be reused by other programs on the host. However, this can cause
|
||||||
|
# significant memory usage if a container has many ports forwarded to it.
|
||||||
|
# Disabling this can save memory.
|
||||||
|
#
|
||||||
|
# enable_port_reservation = true
|
||||||
|
|
||||||
|
# Selects which logging mechanism to use for container engine events.
|
||||||
|
# Valid values are `journald`, `file` and `none`.
|
||||||
|
#
|
||||||
|
# events_logger = "journald"
|
||||||
|
|
||||||
|
# Default transport method for pulling and pushing for images
|
||||||
|
#
|
||||||
|
# image_default_transport = "docker://"
|
||||||
|
|
||||||
|
# Default command to run the infra container
|
||||||
|
#
|
||||||
|
# infra_command = "/pause"
|
||||||
|
|
||||||
|
# Infra (pause) container image name for pod infra containers. When running a
|
||||||
|
# pod, we start a `pause` process in a container to hold open the namespaces
|
||||||
|
# associated with the pod. This container does nothing other then sleep,
|
||||||
|
# reserving the pods resources for the lifetime of the pod.
|
||||||
|
#
|
||||||
|
# infra_image = "k8s.gcr.io/pause:3.1"
|
||||||
|
|
||||||
|
# Specify the locking mechanism to use; valid values are "shm" and "file".
|
||||||
|
# Change the default only if you are sure of what you are doing, in general
|
||||||
|
# "file" is useful only on platforms where cgo is not available for using the
|
||||||
|
# faster "shm" lock type. You may need to run "podman system renumber" after
|
||||||
|
# you change the lock type.
|
||||||
|
#
|
||||||
|
# lock_type** = "shm"
|
||||||
|
|
||||||
|
# Default libpod namespace
|
||||||
|
# If libpod is joined to a namespace, it will see only containers and pods
|
||||||
|
# that were created in the same namespace, and will create new containers and
|
||||||
|
# pods in that namespace.
|
||||||
|
# The default namespace is "", which corresponds to no namespace. When no
|
||||||
|
# namespace is set, all containers and pods are visible.
|
||||||
|
#
|
||||||
|
# namespace = ""
|
||||||
|
|
||||||
|
# Whether to use chroot instead of pivot_root in the runtime
|
||||||
|
#
|
||||||
|
# no_pivot_root = false
|
||||||
|
|
||||||
|
# Number of locks available for containers and pods.
|
||||||
|
# If this is changed, a lock renumber must be performed (e.g. with the
|
||||||
|
# 'podman system renumber' command).
|
||||||
|
#
|
||||||
|
# num_locks = 2048
|
||||||
|
|
||||||
|
# Directory for persistent libpod files (database, etc)
|
||||||
|
# By default, this will be configured relative to where the containers/storage
|
||||||
|
# stores containers
|
||||||
|
# Uncomment to change location from this default
|
||||||
|
#
|
||||||
|
# static_dir = "/var/lib/containers/storage/libpod"
|
||||||
|
|
||||||
|
# Directory for temporary files. Must be tmpfs (wiped after reboot)
|
||||||
|
#
|
||||||
|
# tmp_dir = "/var/run/libpod"
|
||||||
|
|
||||||
|
# Directory for libpod named volumes.
|
||||||
|
# By default, this will be configured relative to where containers/storage
|
||||||
|
# stores containers.
|
||||||
|
# Uncomment to change location from this default.
|
||||||
|
#
|
||||||
|
# volume_path = "/var/lib/containers/storage/volumes"
|
||||||
|
|
||||||
|
# Default OCI runtime
|
||||||
|
#
|
||||||
|
# runtime = "runc"
|
||||||
|
|
||||||
|
# List of the OCI runtimes that support --format=json. When json is supported
|
||||||
|
# libpod will use it for reporting nicer errors.
|
||||||
|
#
|
||||||
|
# runtime_supports_json = ["crun", "runc"]
|
||||||
|
|
||||||
|
# Paths to look for a valid OCI runtime (runc, runv, etc)
|
||||||
|
[libpod.runtimes]
|
||||||
|
# runc = [
|
||||||
|
# "/usr/bin/runc",
|
||||||
|
# "/usr/sbin/runc",
|
||||||
|
# "/usr/local/bin/runc",
|
||||||
|
# "/usr/local/sbin/runc",
|
||||||
|
# "/sbin/runc",
|
||||||
|
# "/bin/runc",
|
||||||
|
# "/usr/lib/cri-o-runc/sbin/runc",
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# crun = [
|
||||||
|
# "/usr/bin/crun",
|
||||||
|
# "/usr/sbin/crun",
|
||||||
|
# "/usr/local/bin/crun",
|
||||||
|
# "/usr/local/sbin/crun",
|
||||||
|
# "/sbin/crun",
|
||||||
|
# "/bin/crun",
|
||||||
|
# "/run/current-system/sw/bin/crun",
|
||||||
|
# ]
|
||||||
|
|
||||||
|
# The [libpod.runtimes] table MUST be the last entry in this file.
|
||||||
|
# (Unless another table is added)
|
||||||
|
# TOML does not provide a way to end a table other than a further table being
|
||||||
|
# defined, so every key hereafter will be part of [runtimes] and not the main
|
||||||
|
# config.
|
346
containers.conf.5.md
Normal file
346
containers.conf.5.md
Normal file
@ -0,0 +1,346 @@
|
|||||||
|
% containers.conf(5) Container engine configuration file
|
||||||
|
|
||||||
|
# NAME
|
||||||
|
containers.conf - The container engine configuration file specifies default
|
||||||
|
configuration options and command-line flags for container engines.
|
||||||
|
|
||||||
|
# DESCRIPTION
|
||||||
|
Container engines like Podman & Buildah read containers.conf file, if it exists
|
||||||
|
and modify the defaults for running containers on the host. containers.conf uses
|
||||||
|
a TOML format that can be easily modified and versioned.
|
||||||
|
|
||||||
|
Container engines read the /usr/share/containers/containers.conf and
|
||||||
|
/etc/containers/containers.conf files if they exists. When running in rootless
|
||||||
|
mode, they also read $HOME/.config/containers/containers.conf files.
|
||||||
|
|
||||||
|
Fields specified in containers conf override the default options, as well as
|
||||||
|
options in previously read containers.conf files.
|
||||||
|
|
||||||
|
Not all options are supported in all container engines.
|
||||||
|
|
||||||
|
Note container engines also use other configuration files for configuring the environment.
|
||||||
|
|
||||||
|
* `storage.conf` for configuration of container and images storage.
|
||||||
|
* `registries.conf` for definition of container registires to search while pulling.
|
||||||
|
container images.
|
||||||
|
* `policy.conf` for controlling which images can be pulled to the system.
|
||||||
|
|
||||||
|
# FORMAT
|
||||||
|
The [TOML format][toml] is used as the encoding of the configuration file.
|
||||||
|
Every option is nested under its table. No bare options are used. The format of
|
||||||
|
TOML can be simplified to:
|
||||||
|
|
||||||
|
[table1]
|
||||||
|
option = value
|
||||||
|
|
||||||
|
[table2]
|
||||||
|
option = value
|
||||||
|
|
||||||
|
[table3]
|
||||||
|
option = value
|
||||||
|
|
||||||
|
[table3.subtable1]
|
||||||
|
option = value
|
||||||
|
|
||||||
|
## CONTAINERS TABLE
|
||||||
|
The containers table contains settings pertaining to the OCI runtime that can
|
||||||
|
configure and manage the OCI runtime.
|
||||||
|
|
||||||
|
**additional_devices**=[]
|
||||||
|
List of additional devices.
|
||||||
|
Specified as 'device-on-host:device-on-container:permissions',
|
||||||
|
for example: "/dev/sdc:/dev/xvdc:rwm".
|
||||||
|
|
||||||
|
**additional_volumes**=[]
|
||||||
|
List of additional volumes.
|
||||||
|
Specified as "directory-on-host:directory-in-container:options",
|
||||||
|
for example: "/db:/var/lib/db:ro".
|
||||||
|
|
||||||
|
**apparmor_profile**="container-default"
|
||||||
|
Used to change the name of the default AppArmor profile of container engines.
|
||||||
|
The default profile name is "container-default".
|
||||||
|
|
||||||
|
**cgroupns**="private"
|
||||||
|
Default way to to create a cgroup namespace for the container.
|
||||||
|
Options are:
|
||||||
|
`private` Create private Cgroup Namespace for the container.
|
||||||
|
`host` Share host Cgroup Namespace with the container.
|
||||||
|
|
||||||
|
**cgroup_manager**="systemd"
|
||||||
|
The cgroup management implementation used for the runtime. Supports `cgroupfs`
|
||||||
|
and `systemd`.
|
||||||
|
|
||||||
|
**default_capabilities**=[]
|
||||||
|
List of default capabilities for containers.
|
||||||
|
|
||||||
|
The default list is:
|
||||||
|
```
|
||||||
|
default_capabilities = [
|
||||||
|
"AUDIT_WRITE",
|
||||||
|
"CHOWN",
|
||||||
|
"DAC_OVERRIDE",
|
||||||
|
"FOWNER",
|
||||||
|
"FSETID",
|
||||||
|
"KILL",
|
||||||
|
"MKNOD",
|
||||||
|
"NET_BIND_SERVICE",
|
||||||
|
"NET_RAW",
|
||||||
|
"SETGID",
|
||||||
|
"SETPCAP",
|
||||||
|
"SETUID",
|
||||||
|
"SYS_CHROOT",
|
||||||
|
]
|
||||||
|
```
|
||||||
|
|
||||||
|
**default_sysctls**=[]
|
||||||
|
A list of sysctls to be set in containers by default,
|
||||||
|
specified as "name=value",
|
||||||
|
for example:"net.ipv4.ping_group_range=0 1000".
|
||||||
|
|
||||||
|
**default_ulimits**=[]
|
||||||
|
A list of ulimits to be set in containers by default,
|
||||||
|
specified as "name=soft-limit:hard-limit",
|
||||||
|
for example:"nofile=1024:2048".
|
||||||
|
|
||||||
|
**dns_options**=[]
|
||||||
|
List of default DNS options to be added to /etc/resolv.conf inside of the
|
||||||
|
container.
|
||||||
|
|
||||||
|
**dns_searches**=[]
|
||||||
|
List of default DNS search domains to be added to /etc/resolv.conf inside of
|
||||||
|
the container.
|
||||||
|
|
||||||
|
**dns_servers**=[]
|
||||||
|
A list of dns servers to override the DNS configuration passed to the
|
||||||
|
container. The special value “none” can be specified to disable creation of
|
||||||
|
/etc/resolv.conf in the container.
|
||||||
|
|
||||||
|
**env**=["PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"]
|
||||||
|
Environment variable list for the container process, used for passing
|
||||||
|
environment variables to the container.
|
||||||
|
|
||||||
|
**env_host**=false
|
||||||
|
Pass all host environment variables into the container.
|
||||||
|
|
||||||
|
**hooks_dir**=["/etc/containers/oci/hooks.d", ...]
|
||||||
|
Path to the OCI hooks directories for automatically executed hooks.
|
||||||
|
|
||||||
|
**http_proxy**=false
|
||||||
|
Default proxy environment variables will be passed into the container.
|
||||||
|
The environment variables passed in include:
|
||||||
|
`http_proxy`, `https_proxy`, `ftp_proxy`, `no_proxy`, and the upper case
|
||||||
|
versions of these. The `no_proxy` option is needed when host system uses a proxy
|
||||||
|
but container should not use proxy. Proxy environment variables specified for
|
||||||
|
the container in any other way will override the values passed from the host.
|
||||||
|
|
||||||
|
**init**=false
|
||||||
|
Run an init inside the container that forwards signals and reaps processes.
|
||||||
|
|
||||||
|
**init_path**="/usr/libexec/podman/catatonit"
|
||||||
|
Path to the container-init binary, which forwards signals and reaps processes
|
||||||
|
within containers. Note that the container-init binary will only be used when
|
||||||
|
the `--init` for podman-create and podman-run is set.
|
||||||
|
|
||||||
|
**ipcns**="private"
|
||||||
|
Default way to to create a IPC namespace for the container.
|
||||||
|
Options are:
|
||||||
|
`private` Create private IPC Namespace for the container.
|
||||||
|
`host` Share host IPC Namespace with the container.
|
||||||
|
|
||||||
|
**label**=true
|
||||||
|
Indicates whether the container engines use MAC(SELinux) container separation via via labeling. Flag is ignored on disabled systems.
|
||||||
|
|
||||||
|
**log_driver**="k8s-file"
|
||||||
|
Logging driver for the container. Available options: `k8s-file` and `journald`.
|
||||||
|
|
||||||
|
**log_size_max**=-1
|
||||||
|
Maximum size allowed for the container's log file. Negative numbers indicate
|
||||||
|
that no size limit is imposed. If it is positive, it must be >= 8192 to
|
||||||
|
match/exceed conmon's read buffer. The file is truncated and re-opened so the
|
||||||
|
limit is never exceeded.
|
||||||
|
|
||||||
|
**netns**="private"
|
||||||
|
Default way to to create a NET namespace for the container.
|
||||||
|
Options are:
|
||||||
|
`private` Create private NET Namespace for the container.
|
||||||
|
`host` Share host NET Namespace with the container.
|
||||||
|
`none` Containers do not use the network.
|
||||||
|
|
||||||
|
**no_hosts**=false
|
||||||
|
Create /etc/hosts for the container. By default, container engines manage
|
||||||
|
/etc/hosts, automatically adding the container's own IP address.
|
||||||
|
|
||||||
|
**pids_limit**=1024
|
||||||
|
Maximum number of processes allowed in a container. 0 indicates that no limit
|
||||||
|
is imposed.
|
||||||
|
|
||||||
|
**pidns**="private"
|
||||||
|
Default way to to create a PID namespace for the container.
|
||||||
|
Options are:
|
||||||
|
`private` Create private PID Namespace for the container.
|
||||||
|
`host` Share host PID Namespace with the container.
|
||||||
|
|
||||||
|
**seccomp_profile**="/usr/share/containers/seccomp.json"
|
||||||
|
Path to the seccomp.json profile which is used as the default seccomp profile
|
||||||
|
for the runtime.
|
||||||
|
|
||||||
|
**shm_size**="65536k"
|
||||||
|
Size of `/dev/shm`. The format is `<number><unit>`. `number` must be greater
|
||||||
|
than `0`.
|
||||||
|
Unit is optional and can be:
|
||||||
|
`b` (bytes), `k` (kilobytes), `m`(megabytes), or `g` (gigabytes).
|
||||||
|
If you omit the unit, the system uses bytes. If you omit the size entirely,
|
||||||
|
the system uses `65536k`.
|
||||||
|
|
||||||
|
**utsns**="private"
|
||||||
|
Default way to to create a UTS namespace for the container.
|
||||||
|
Options are:
|
||||||
|
`private` Create private UTS Namespace for the container.
|
||||||
|
`host` Share host UTS Namespace with the container.
|
||||||
|
|
||||||
|
**userns**="host"
|
||||||
|
Default way to to create a USER namespace for the container.
|
||||||
|
Options are:
|
||||||
|
`private` Create private USER Namespace for the container.
|
||||||
|
`host` Share host USER Namespace with the container.
|
||||||
|
|
||||||
|
**userns_size**=65536
|
||||||
|
Number of UIDs to allocate for the automatic container creation. UIDs are
|
||||||
|
allocated from the “container” UIDs listed in /etc/subuid & /etc/subgid.
|
||||||
|
|
||||||
|
## NETWORK TABLE
|
||||||
|
The `network` table contains settings pertaining to the management of CNI
|
||||||
|
plugins.
|
||||||
|
|
||||||
|
**cni_plugin_dirs**=["/opt/cni/bin/",]
|
||||||
|
List of paths to directories where CNI plugin binaries are located.
|
||||||
|
|
||||||
|
**default_network**="podman"
|
||||||
|
The network name of the default CNI network to attach pods to.
|
||||||
|
|
||||||
|
**network_config_dir**="/etc/cni/net.d/"
|
||||||
|
Path to the directory where CNI configuration files are located.
|
||||||
|
|
||||||
|
## LIBPOD TABLE
|
||||||
|
The `libpod` table contains configuration options used to set up a libpod runtime.
|
||||||
|
|
||||||
|
**conmon_env_vars**=[]
|
||||||
|
Environment variables to pass into Conmon.
|
||||||
|
|
||||||
|
**conmon_path**=[]
|
||||||
|
Paths to search for the conmon container manager binary. If the paths are
|
||||||
|
empty or no valid path was found, then the `$PATH` environment variable will be
|
||||||
|
used as the fallback.
|
||||||
|
|
||||||
|
The default list is:
|
||||||
|
```
|
||||||
|
conmon_path=[
|
||||||
|
"/usr/libexec/podman/conmon",
|
||||||
|
"/usr/local/libexec/podman/conmon",
|
||||||
|
"/usr/local/lib/podman/conmon",
|
||||||
|
"/usr/bin/conmon",
|
||||||
|
"/usr/sbin/conmon",
|
||||||
|
"/usr/local/bin/conmon",
|
||||||
|
"/usr/local/sbin/conmon",
|
||||||
|
"/run/current-system/sw/bin/conmon",
|
||||||
|
]
|
||||||
|
```
|
||||||
|
|
||||||
|
**detach_keys**="ctrl-p,ctrl-q"
|
||||||
|
Keys sequence used for detaching a container.
|
||||||
|
Specify the keys sequence used to detach a container.
|
||||||
|
Format is a single character `[a-Z]` or a comma separated sequence of
|
||||||
|
`ctrl-<value>`, where `<value>` is one of:
|
||||||
|
`a-z`, `@`, `^`, `[`, `\`, `]`, `^` or `_`
|
||||||
|
|
||||||
|
**enable_port_reservation**=true
|
||||||
|
Determines whether libpod will reserve ports on the host when they are
|
||||||
|
forwarded to containers. When enabled, when ports are forwarded to containers,
|
||||||
|
they are held open by conmon as long as the container is running, ensuring that
|
||||||
|
they cannot be reused by other programs on the host. However, this can cause
|
||||||
|
significant memory usage if a container has many ports forwarded to it.
|
||||||
|
Disabling this can save memory.
|
||||||
|
|
||||||
|
**events_logger**="journald"
|
||||||
|
Default method to use when logging events.
|
||||||
|
Valid values: `file`, `journald`, and `none`.
|
||||||
|
|
||||||
|
**image_default_transport**="docker://"
|
||||||
|
Default transport method for pulling and pushing images.
|
||||||
|
|
||||||
|
**infra_command**="/pause"
|
||||||
|
Command to run the infra container.
|
||||||
|
|
||||||
|
**infra_image**="k8s.gcr.io/pause:3.1"
|
||||||
|
Infra (pause) container image name for pod infra containers. When running a
|
||||||
|
pod, we start a `pause` process in a container to hold open the namespaces
|
||||||
|
associated with the pod. This container does nothing other then sleep,
|
||||||
|
reserving the pods resources for the lifetime of the pod.
|
||||||
|
|
||||||
|
**lock_type**="shm"
|
||||||
|
Specify the locking mechanism to use; valid values are "shm" and "file".
|
||||||
|
Change the default only if you are sure of what you are doing, in general
|
||||||
|
"file" is useful only on platforms where cgo is not available for using the
|
||||||
|
faster "shm" lock type. You may need to run "podman system renumber" after you
|
||||||
|
change the lock type.
|
||||||
|
|
||||||
|
**namespace**=""
|
||||||
|
Default libpod namespace. If libpod is joined to a namespace, it will see
|
||||||
|
only containers and pods that were created in the same namespace, and will
|
||||||
|
create new containers and pods in that namespace. The default namespace is "",
|
||||||
|
which corresponds to no namespace. When no namespace is set, all containers
|
||||||
|
and pods are visible.
|
||||||
|
|
||||||
|
**no_pivot_root**=false
|
||||||
|
Whether to use chroot instead of pivot_root in the runtime.
|
||||||
|
|
||||||
|
**num_locks**=2048
|
||||||
|
Number of locks available for containers and pods. Each created container or
|
||||||
|
pod consumes one lock. The default number available is 2048. If this is
|
||||||
|
changed, a lock renumbering must be performed, using the
|
||||||
|
`podman system renumber` command.
|
||||||
|
|
||||||
|
**runtime**="crun"
|
||||||
|
Default OCI specific runtime in runtimes that will be used by default. Must
|
||||||
|
refer to a member of the runtimes table.
|
||||||
|
|
||||||
|
**runtime_supports_json**=["crun", "runc"]
|
||||||
|
The list of the OCI runtimes that support `--format=json`.
|
||||||
|
|
||||||
|
**runtime_supports_nocgroups**=["crun"]
|
||||||
|
The list of OCI runtimes that support running containers without CGroups.
|
||||||
|
|
||||||
|
**static_dir**="/var/lib/containers/storage/libpod"
|
||||||
|
Directory for persistent libpod files (database, etc).
|
||||||
|
By default this will be configured relative to where containers/storage
|
||||||
|
stores containers.
|
||||||
|
|
||||||
|
**tmp_dir**="/var/run/libpod"
|
||||||
|
The path to a temporary directory to store per-boot container.
|
||||||
|
Must be a tmpfs (wiped after reboot).
|
||||||
|
|
||||||
|
**volume_path**="/var/lib/containers/storage/volumes"
|
||||||
|
Directory where named volumes will be created in using the default volume
|
||||||
|
driver.
|
||||||
|
By default this will be configured relative to where containers/storage store
|
||||||
|
containers. This convention is followed by the default volume driver, but may
|
||||||
|
not be by other drivers.
|
||||||
|
|
||||||
|
# FILES
|
||||||
|
Distributions often provide a `/usr/share/containers/containers.conf` file to
|
||||||
|
define default container configuration. Administrators can override fields in
|
||||||
|
this file by creating `/etc/containers/containers.conf` to specify their own
|
||||||
|
configuration. Rootless users can further override fields in the config by
|
||||||
|
creating a config file stored in the
|
||||||
|
`$HOME/.config/containers/containers.conf` file.
|
||||||
|
|
||||||
|
If the `CONTAINERS_CONF` path environment variable is set, just
|
||||||
|
this path will be used. This is primarily used for testing.
|
||||||
|
|
||||||
|
Fields specified in the containers.conf file override the default options, as
|
||||||
|
well as options in previously read containers.conf files.
|
||||||
|
|
||||||
|
# SEE ALSO
|
||||||
|
containers-storage.conf(5), containers-policy.json(5), containers-registries.conf(5)
|
||||||
|
|
||||||
|
[toml]: https://github.com/toml-lang/toml
|
@ -527,7 +527,8 @@
|
|||||||
"names": [
|
"names": [
|
||||||
"s390_pci_mmio_read",
|
"s390_pci_mmio_read",
|
||||||
"s390_pci_mmio_write",
|
"s390_pci_mmio_write",
|
||||||
"s390_runtime_instr"
|
"s390_runtime_instr",
|
||||||
|
"clone"
|
||||||
],
|
],
|
||||||
"action": "SCMP_ACT_ALLOW",
|
"action": "SCMP_ACT_ALLOW",
|
||||||
"args": [],
|
"args": [],
|
||||||
|
14
skopeo.spec
14
skopeo.spec
@ -46,7 +46,7 @@ Epoch: 1
|
|||||||
Epoch: 2
|
Epoch: 2
|
||||||
%endif
|
%endif
|
||||||
Version: 0.1.41
|
Version: 0.1.41
|
||||||
Release: 26.dev.git%{shortcommit0}%{?dist}
|
Release: 27.dev.git%{shortcommit0}%{?dist}
|
||||||
Summary: Inspect container images and repositories on registries
|
Summary: Inspect container images and repositories on registries
|
||||||
License: ASL 2.0
|
License: ASL 2.0
|
||||||
URL: %{git0}
|
URL: %{git0}
|
||||||
@ -63,6 +63,8 @@ Source9: containers-signature.5.md
|
|||||||
Source10: containers-transports.5.md
|
Source10: containers-transports.5.md
|
||||||
Source11: containers-certs.d.5.md
|
Source11: containers-certs.d.5.md
|
||||||
Source12: containers-registries.d.5.md
|
Source12: containers-registries.d.5.md
|
||||||
|
Source13: containers.conf
|
||||||
|
Source14: containers.conf.5.md
|
||||||
|
|
||||||
%if 0%{?fedora}
|
%if 0%{?fedora}
|
||||||
BuildRequires: go-srpm-macros
|
BuildRequires: go-srpm-macros
|
||||||
@ -322,10 +324,12 @@ go-md2man -in %{SOURCE9} -out %{buildroot}%{_mandir}/man5/containers-signature.5
|
|||||||
go-md2man -in %{SOURCE10} -out %{buildroot}%{_mandir}/man5/containers-transports.5
|
go-md2man -in %{SOURCE10} -out %{buildroot}%{_mandir}/man5/containers-transports.5
|
||||||
go-md2man -in %{SOURCE11} -out %{buildroot}%{_mandir}/man5/containers-certs.d.5
|
go-md2man -in %{SOURCE11} -out %{buildroot}%{_mandir}/man5/containers-certs.d.5
|
||||||
go-md2man -in %{SOURCE12} -out %{buildroot}%{_mandir}/man5/containers-registries.d.5
|
go-md2man -in %{SOURCE12} -out %{buildroot}%{_mandir}/man5/containers-registries.d.5
|
||||||
|
go-md2man -in %{SOURCE14} -out %{buildroot}%{_mandir}/man5/containers.conf.5
|
||||||
|
|
||||||
mkdir -p %{buildroot}%{_datadir}/containers
|
mkdir -p %{buildroot}%{_datadir}/containers
|
||||||
install -m0644 %{SOURCE3} %{buildroot}%{_datadir}/containers/mounts.conf
|
install -m0644 %{SOURCE3} %{buildroot}%{_datadir}/containers/mounts.conf
|
||||||
install -m0644 %{SOURCE7} %{buildroot}%{_datadir}/containers/seccomp.json
|
install -m0644 %{SOURCE7} %{buildroot}%{_datadir}/containers/seccomp.json
|
||||||
|
install -m0644 %{SOURCE13} %{buildroot}%{_datadir}/containers/containers.conf
|
||||||
|
|
||||||
# install secrets patch directory
|
# install secrets patch directory
|
||||||
install -d -p -m 755 %{buildroot}/%{_datadir}/rhel/secrets
|
install -d -p -m 755 %{buildroot}/%{_datadir}/rhel/secrets
|
||||||
@ -410,11 +414,13 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
|
|||||||
%config(noreplace) %{_sysconfdir}/containers/registries.d/default.yaml
|
%config(noreplace) %{_sysconfdir}/containers/registries.d/default.yaml
|
||||||
%config(noreplace) %{_sysconfdir}/containers/storage.conf
|
%config(noreplace) %{_sysconfdir}/containers/storage.conf
|
||||||
%config(noreplace) %{_sysconfdir}/containers/registries.conf
|
%config(noreplace) %{_sysconfdir}/containers/registries.conf
|
||||||
|
%ghost %{_sysconfdir}/containers/containers.conf
|
||||||
%dir %{_sharedstatedir}/containers/sigstore
|
%dir %{_sharedstatedir}/containers/sigstore
|
||||||
%{_mandir}/man5/*
|
%{_mandir}/man5/*
|
||||||
%dir %{_datadir}/containers
|
%dir %{_datadir}/containers
|
||||||
%{_datadir}/containers/mounts.conf
|
%{_datadir}/containers/mounts.conf
|
||||||
%{_datadir}/containers/seccomp.json
|
%{_datadir}/containers/seccomp.json
|
||||||
|
%{_datadir}/containers/containers.conf
|
||||||
%dir %{_datadir}/rhel/secrets
|
%dir %{_datadir}/rhel/secrets
|
||||||
%{_datadir}/rhel/secrets/etc-pki-entitlement
|
%{_datadir}/rhel/secrets/etc-pki-entitlement
|
||||||
%{_datadir}/rhel/secrets/redhat.repo
|
%{_datadir}/rhel/secrets/redhat.repo
|
||||||
@ -434,7 +440,11 @@ export GOPATH=%{buildroot}/%{gopath}:$(pwd)/vendor:%{gopath}
|
|||||||
%{_datadir}/%{name}/test
|
%{_datadir}/%{name}/test
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Thu Feb 6 2019 Dan Walsh <dwalsh@fedoraproject.org> - 1:0.1.41-26.dev.git7cbb8ad
|
* Mon Feb 17 2020 Dan Walsh <dwalsh@fedoraproject.org> - 1:0.1.41-27.dev.git7cbb8ad
|
||||||
|
- Allow s390x to use clone syscall in seccomp.json
|
||||||
|
- Add support for containers.conf and man page
|
||||||
|
|
||||||
|
* Thu Feb 6 2020 Dan Walsh <dwalsh@fedoraproject.org> - 1:0.1.41-26.dev.git7cbb8ad
|
||||||
- Remove quay.io from list of search registries, removes risk of squatters.
|
- Remove quay.io from list of search registries, removes risk of squatters.
|
||||||
- Update man pages to match upstream
|
- Update man pages to match upstream
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user