podman(1)

📦
version 6.1.4 · 10 versions
, in arch rolling, nixpkgs unstable

podman(1) — General Commands Manual 🫶💅

🌸 NAME 🌸

  • podman — simple management tool for pods, containers and images. periodt.

✨ SYNOPSIS ✨

podman [options] command

that's the whole vibe, bestie 🎀

🦋 DESCRIPTION 🦋

Okay so Podman (short for Pod Manager) is a fully featured container engine that is a simple daemonless tool. It gives you a Docker-CLI comparable command line that eases the transition from other container engines and allows the management of pods, containers and images. Simply put: alias docker=podman. Most Podman commands can be run as a regular user, without requiring additional privileges. slay. ✨

Podman uses Buildah(1) internally to create container images. Both tools share image (not container) storage, hence each can use or manipulate images (but not containers) created by the other. iykyk. 🦋

Default settings for flags are defined in containers.conf. Most settings for Remote connections use the server's containers.conf, except when documented in man pages.

To manage containers, pods, volumes, networks, and images declaratively via systemd, use quadlet files. See podman-quadlet(1) and podman-systemd.unit(5). 🌈

podman [GLOBAL OPTIONS]

👑 GLOBAL OPTIONS 👑

🎀 --cdi-spec-dir=path

The CDI spec directory path (and yes, it may be set multiple times). Default path is /etc/cdi. 🫶

💅 --cgroup-manager=manager

The CGroup manager to use for container cgroups. Supported values are cgroupfs or systemd. Default is systemd unless overridden in the containers.conf file.

Note: setting this flag can cause certain commands to break when called on containers previously created by the other CGroup manager type. 😭

Also, cgroupfs doesn't work in Rootless mode and containers cgroups aren't used.

✨ --config

Location of config file. Mainly for docker compatibility — only the authentication parts of the config are supported.

🦋 --conmon

Path of the conmon binary (default path is configured in containers.conf).

🌸 --connection, -c

Connection to use for remote podman, including Mac and Windows (excluding WSL2) machines. Default connection is configured in containers.conf. Setting this option switches the --remote option to true. Remote connections use local containers.conf for default.

🔥 --events-backend=type

Backend to use for storing events. Allowed values are file, journald, and none. When file is specified, the events are stored under <tmpdir>/events/events.log (see --tmpdir below).

🫶 --help, -h

Print usage statement.

🧚 --hooks-dir=path

Each *.json file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see oci-hooks(5). Podman and libpod currently support both the 1.0.0 and 0.1.0 hook schemas, although the 0.1.0 schema is deprecated. 🫣

This option may be set multiple times; paths from later options have higher precedence (oci-hooks(5) discusses directory precedence).

For the annotation conditions, libpod uses any annotations set in the generated OCI configuration.

For the bind-mount conditions, only mounts explicitly requested by the caller via --volume are considered. Bind mounts that libpod inserts by default (e.g. /dev/shm) are not considered.

If --hooks-dir is unset for root callers, Podman and libpod currently default to /usr/share/containers/oci/hooks.d and /etc/containers/oci/hooks.d in order of increasing precedence. Using these defaults is deprecated. Migrate to explicitly setting --hooks-dir.

Podman and libpod currently support an additional precreate state which is called before the runtime's create operation. Unlike the other stages, which receive the container state on their standard input, precreate hooks receive the proposed runtime configuration on their standard input. They may alter that configuration as they see fit, and write the altered form to their standard output.

WARNING: the precreate hook allows powerful changes to occur, such as adding additional mounts to the runtime configuration. That power also makes it easy to break things. Before reporting libpod errors, try running a container with precreate hooks disabled to see if the problem is due to one of the hooks. 💀

🔑 --identity=path

Path to ssh identity file. If the identity file has been encrypted, podman prompts the user for the passphrase. If no identity file is provided and no user is given, podman defaults to the user running the podman command. Podman prompts for the login password on the remote server.

Identity value resolution precedence:

  • command line value
  • environment variable CONTAINER_SSHKEY, if CONTAINER_HOST is found
  • containers.conf — Remote connections use local containers.conf for default.

🌈 --imagestore=path

Path of the imagestore where images are stored. By default, the storage library stores all the images in the graphroot, but if an imagestore is provided, then the storage library will store newly pulled images in the provided imagestore and keep using the graphroot for everything else. If the user is using the overlay driver, then the images which were already part of the graphroot will still be accessible. ✨

This will override the imagestore option in containers-storage.conf(5), refer to containers-storage.conf(5) for more details.

🍓 --log-level=level

Log messages at and above specified level: debug, info, warn, error, fatal or panic (default: warn).

🎀 --module=path

Load the specified containers.conf(5) module. Can be an absolute or relative path. Please refer to containers.conf(5) for details.

This flag is not supported on the remote client, including Mac and Windows (excluding WSL2) machines. Further note that the flag is a root-level flag and must be specified before any Podman sub-command. 🙈

🌐 --network-config-dir=directory

Path to the directory where network configuration files are located. The default is /etc/containers/networks as root and $graphroot/networks as rootless.

🎯 --out=path

Redirect the output of podman to the specified path without affecting the container output or its logs. This parameter can be used to capture the output from any of podman's commands directly into a file and enable suppression of podman's output by specifying /dev/null as the path. To explicitly disable the container logging, the --log-driver option should be used.

🛰️ --remote, -r

When true, access to the Podman service is remote. Defaults to false. Settings can be modified in the containers.conf file. If the CONTAINER_HOST environment variable is set, the --remote option defaults to true.

👑 --root=value

Storage root dir in which data, including images, is stored (default: /var/lib/containers/storage for UID 0, $HOME/.local/share/containers/storage for other users). Default root dir configured in containers-storage.conf(5).

This option causes the storage.options.<driver> settings in containers-storage.conf(5) and the STORAGE_OPTS environment variable to be ignored. The user must specify additional options via the --storage-opt flag. 😭

🧁 --runroot=value

Storage state directory where all state information is stored (default: /run/containers/storage for UID 0, /run/user/$UID/run for other users). Default state dir configured in containers-storage.conf(5).

⚙️ --runtime=value

Name of the OCI runtime as specified in containers.conf or absolute path to the OCI compatible binary used to run containers.

🚀 --runtime-flag=flag

Adds global flags for the container runtime. To list the supported flags, please consult the manpages of the selected container runtime (runc is the default runtime, the manpage to consult is runc(8). When the machine is configured for cgroup V2, the default runtime is crun, the manpage to consult is crun(8).).

Default runtime flags can be added in containers.conf.

Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json to podman build, the option given can be --runtime-flag log-format=json. 💅

🐚 --ssh=value

This option allows the user to change the ssh mode, meaning that rather than using the default golang mode, one can instead use --ssh=native to use the installed ssh binary and config file declared in containers.conf.

💾 --storage-driver=value

Storage driver. The default storage driver is configured in containers-storage.conf(5). The STORAGE_DRIVER environment variable overrides the default. The --storage-driver specified driver overrides all.

This option causes the storage.options.<driver> settings in containers-storage.conf(5) and the STORAGE_OPTS environment variable to be ignored. The user must specify additional options via the --storage-opt flag.

🗄️ --storage-opt=value

Specify a storage driver option. Default storage driver options are configured in containers-storage.conf(5). The STORAGE_OPTS environment variable overrides the default. The --storage-opt specified options override all. Specify --storage-opt="" so no storage options is used.

The --root and --storage-driver options clear the default storage options, ignoring the default storage driver options from containers-storage.conf(5) and the STORAGE_OPTS environment variable.

📝 --syslog

Output logging information to syslog as well as the console (default false).

On remote clients, including Mac and Windows (excluding WSL2) machines, logging is directed to the file $HOME/.config/containers/podman.log.

🔐 --tls-ca=path

Path to a PEM file containing the certificate authority bundle to verify the server's certificate against.

🪪 --tls-cert=path

Path to a PEM file containing the TLS client certificate to present to the server. --tls-key must also be provided.

📜 --tls-details=path

Path to a containers-tls-details.yaml(5) file, affecting TLS behavior throughout the program.

If not set, defaults to a reasonable default that may change over time (depending on system’s global policy, version of the program, version of the Go language, and the like).

Users should generally not use this option unless they have a process to ensure that the configuration will be kept up to date.

🔑 --tls-key=path

Path to a PEM file containing the private key matching --tls-cert. --tls-cert must also be provided.

🗂️ --tmpdir=path

Path to the tmp directory, for libpod runtime content. Defaults to $XDG_RUNTIME_DIR/libpod/tmp as rootless and /run/libpod/tmp as rootful.

NOTE --tmpdir is not used for the temporary storage of downloaded images. Use the environment variable TMPDIR to change the temporary storage location of downloaded container images. Podman defaults to use /var/tmp. 🎀
  • --transient-store — okay so this flips on a global transient storage mode where all container metadata is stored on non-persistent media (i.e. in the location specified by --runroot). This mode allows starting containers faster, as well as guaranteeing a fresh state on boot in case of unclean shutdowns or other problems. Heads up, bestie: it is not compatible with a traditional model where containers persist across reboots.

Only the Podman database (container and volume metadata) is stored transiently. Volume data on disk is not affected and persists across reboots. After a reboot, previously created volumes will not appear in podman volume ls because their database entries were lost, but the underlying data remains in the volume storage directory. If a container later creates a volume with the same name, it will reuse the existing data. To clean up leftover volume data that is no longer tracked by the database, use podman system prune --external.

It should be used consistently across all Podman commands and not mixed with regular (non-transient) usage within the same environment.

Default value for this is configured in containers-storage.conf(5).

  • --url=value — URL to access Podman service (default from containers.conf, rootless unix:///run/user/$UID/podman/podman.sock or as root unix:///run/podman/podman.sock). Setting this option switches the --remote option to true.
    • CONTAINER_HOST is of the format <schema>://[<user[:<password>]@]<host>[:<port>][<path>]

Details:

  • schema is one of:
    • ssh (default): a local unix(7) socket on the named host and port, reachable via SSH
    • tcp: an unencrypted, unauthenticated TCP connection to the named host and port
    • unix: a local unix(7) socket at the specified path, or the default for the user
  • user defaults to either root or the current running user (ssh only)
  • password has no default (ssh only)
  • host must be provided and is either the IP or name of the machine hosting the Podman service (ssh and tcp)
  • port defaults to 22 (ssh and tcp)
  • path defaults to either /run/podman/podman.sock, or /run/user/$UID/podman/podman.sock if running rootless (unix), or must be explicitly specified (ssh)

URL value resolution precedence:

  • command line value
  • environment variable CONTAINER_HOST
  • engine.service_destinations table in containers.conf, excluding the /usr/share/containers directory
  • unix:///run/podman/podman.sock

Remote connections use local containers.conf for default.

Some example URL values in valid formats:

  • unix:///run/podman/podman.sock
  • unix:///run/user/$UID/podman/podman.sock
  • ssh://notroot@localhost:22/run/user/$UID/podman/podman.sock
  • ssh://root@localhost:22/run/podman/podman.sock
  • tcp://localhost:34451
  • tcp://127.0.0.1:34451
  • --version, -v — Print the version
  • --volumepath=value — Volume directory where builtin volume information is stored (default: /var/lib/containers/storage/volumes for UID 0, $HOME/.local/share/containers/storage/volumes for other users). Default volume path can be overridden in containers.conf.

🌈 ENVIRONMENT VARIABLES 🌈

Podman can set up environment variables from env of [engine] table in containers.conf. These variables can be overridden by passing environment variables before the podman commands.

  • CONTAINERS_CONF — Set default locations of containers.conf file
  • CONTAINERS_REGISTRIES_CONF — Set default location of the registries.conf file.
  • CONTAINERS_STORAGE_CONF — Set default location of the storage.conf file.
  • CONTAINER_CONNECTION — Override default --connection value to access Podman service. Automatically enables the --remote option.
  • CONTAINER_HOST — Set default --url value to access Podman service. Automatically enables --remote option.
  • CONTAINER_SSHKEY — Set default --identity path to ssh key file value used to access Podman service.
  • PODMAN_CONNECTIONS_CONF — The path to the file where the system connections and farms created with podman system connection add and podman farm add are stored, by default it uses ~/.config/containers/podman-connections.json.
  • STORAGE_DRIVER — Set default --storage-driver value.
  • STORAGE_OPTS — Set default --storage-opt value. Overrides storage driver options in containers-storage.conf(5). Ignored when the --root or --storage-driver options are set.
  • TMPDIR — Set the temporary storage location of downloaded container images. Podman defaults to use /var/tmp.
  • XDG_CONFIG_HOME — In Rootless mode configuration files are read from XDG_CONFIG_HOME when specified, otherwise in the home directory of the user under $HOME/.config/containers.
  • XDG_DATA_HOME — In Rootless mode images are pulled under XDG_DATA_HOME when specified, otherwise in the home directory of the user under $HOME/.local/share/containers/storage.
  • XDG_RUNTIME_DIR — In Rootless mode temporary configuration data is stored in ${XDG_RUNTIME_DIR}/containers.
  • PODMAN_NO_PAUSE_PROCESS — In Rootless mode, when set to a value other than "0", Podman does not use a pause process. Namespace file handles are stored to allow rejoining the existing user and mount namespace if they are still alive.

🛰️ REMOTE ACCESS 🛰️

The Podman command can be used with remote services using the --remote flag. Connections can be made using local unix domain sockets, ssh or directly to tcp sockets. When specifying the podman --remote flag, only the global options --url, --identity, --log-level, --connection are used.

Connection information can also be managed using the containers.conf file.

🚦 EXIT CODES 🚦

The exit code from podman gives information about why the container failed to run or why it exited. When podman commands exit with a non-zero code, the exit codes follow the chroot standard, see below:

  • 125 — The error is with podman itself
$ podman run --foo busybox; echo $?
Error: unknown flag: --foo
125
  • 126 — Executing a container command and the command cannot be invoked
$ podman run busybox /etc; echo $?
Error: container_linux.go:346: starting container process caused "exec: \"/etc\": permission denied": OCI runtime error
126
  • 127 — Executing a container command and the command cannot be found
$ podman run busybox foo; echo $?
Error: container_linux.go:346: starting container process caused "exec: \"foo\": executable file not found in $PATH": OCI runtime error
127

Exit code otherwise, podman returns the exit code of the container command

$ podman run busybox /bin/sh -c 'exit 3'; echo $?
3

✨ COMMANDS ✨

okay bestie, this is the part you actually came for 💅 this is the whole command menu — every single subcommand podman ships, in the order the manpage lists them, with a tiny lil "what does this even do" next to each one. skim it like a menu, screenshot it, whatever, just know these are all real and they're all waiting for you 🫶

and yes, podman-kube(1) really does sit after podman-pause(1) and podman-pod(1) really is last — that's just the order, don't come for me, I didn't write the table 😭 the vibes are alphabetical-ish and then they just... stop being alphabetical. iconic behavior honestly 💜

...and the list keeps going, bestie, because Podman has so many commands and honestly? iconic behavior 💅 here's the rest of the lineup:

  • podman-port(1) — Lists the port mappings for a container. where's it listening, what's exposed, all that 🌸
  • podman-ps(1) — Prints out info about containers. the classic "what's running rn" check 👀
  • podman-pull(1) — Pulls an image from a registry. grab it from the internet, slay 🎀
  • podman-push(1) — Pushes an image, manifest list or image index from local storage to elsewhere. sending your stuff out into the world ✨
  • podman-quadlet(1) — Lets users manage Quadlets. yes that's a real word, yes it's cute 🦋
  • podman-rename(1) — Renames an existing container. glow-up for your container's name 🙈
  • podman-restart(1) — Restarts one or more containers. the ol' turn-it-off-and-on-again 🔥
  • podman-rm(1) — Removes one or more containers. bye bestie 💀
  • podman-rmi(1) — Removes one or more locally stored images. clearing out the local stash 🧚
  • podman-run(1) — Runs a command in a new container. THE main character of the whole tool, fr fr 👑
  • podman-save(1) — Saves image(s) to an archive or directory. packing it up for later 🎀
  • podman-search(1) — Searches a registry for an image. window shopping but make it containers 🛍️
  • podman-secret(1) — Manages podman secrets. secrets secrets are no fun unless... okay nvm, it manages them 🤫
  • podman-start(1) — Starts one or more containers. let's goooo 🌈
  • podman-stats(1) — Displays a live stream of one or more container's resource usage statistics. like top but for your containers, live and unfiltered 📊
  • podman-stop(1) — Stops one or more running containers. take a nap babe 😴
  • podman-system(1) — Manages podman. the meta one, managing the manager ✨
  • podman-tag(1) — Adds an additional name to a local image. aliases but for images 💖
  • podman-top(1) — Displays the running processes of a container. peek inside and see who's working 🕵️
  • podman-unmount(1) — Unmounts a working container's root filesystem. detach era 🦋
  • podman-unpause(1) — Unpauses one or more containers. wakey wakey 🌸
  • podman-unshare(1) — Runs a command inside of a modified user namespace. the niche one, lowkey powerful 💜
  • podman-untag(1) — Removes one or more names from a locally-stored image. un-aliasing, no cap 💅
  • podman-update(1) — Updates the configuration of a given container. fresh fit, same container 🔥
  • podman-version(1) — Displays the Podman version information. what are we working with here ⭐
  • podman-volume(1) — Simple management tool for volumes. the storage bestie 🍓
  • podman-wait(1) — Waits on one or more containers to stop and prints their exit codes. patient queen energy, waits then reports the receipts ⏳
ok that's the whole command family tree and every single one has its own man page — go read the one you need, i believe in you 🫶

💖 CONFIGURATION FILES 💖

Okay bestie, this is the part where Podman tells you where it keeps its little notebooks of settings. Buckle up. 🎀

📓 containers.conf

Paths, in order:

  • /usr/share/containers/containers.conf
  • /etc/containers/containers.conf
  • $HOME/.config/containers/containers.conf

Podman has builtin defaults for command line options, and you can override those defaults with the containers.conf config files. That's it, that's the whole vibe.

Distributions ship the /usr/share/containers/containers.conf file with their default settings. Admins can override fields in it by creating /etc/containers/containers.conf. And users can further modify defaults by creating $HOME/.config/containers/containers.conf. Podman merges its builtin defaults with the specified fields from these files, if they exist. Precedence, from most to least powerful: fields in the user's file override the administrator's file, which overrides the distribution's file, which overrides the builtin defaults. It's giving hierarchy. 👑

If no containers.conf file is found, Podman just uses builtin defaults. No notes.

And if the CONTAINERS_CONF environment variable is set, then its value is used for the containers.conf file rather than the default. Env var said "I'm the main character now." 💅

📓 mounts.conf

  • /usr/share/containers/mounts.conf

The mounts.conf file specifies volume mount directories that are automatically mounted inside containers when you run podman run or podman start. Admins can override the defaults file by creating /etc/containers/mounts.conf.

When Podman runs in rootless mode, $HOME/.config/containers/mounts.conf overrides the default if it exists. For details, see containers-mounts.conf(5).

📓 policy.json

  • /etc/containers/policy.json
  • $HOME/.config/containers/policy.json

Signature verification policy files specify policy — like trusted keys — that applies when deciding whether to accept an image, or individual signatures of that image, as valid. For details, see containers-policy.json(5). This is the bouncer at the club checking IDs, fr fr. 🪪

📓 registries.conf

  • /etc/containers/registries.conf
  • $HOME/.config/containers/registries.conf

registries.conf is the configuration file which specifies which container registries is consulted when completing image names which do not include a registry or domain portion. (Yes, that's the original wording, we love a legacy sentence 😭)

Non root users of Podman can create $HOME/.config/containers/registries.conf to be used instead of the system defaults.

If the CONTAINERS_REGISTRIES_CONF environment variable is set, then its value is used for the registries.conf file rather than the default. ✨

📓 storage.conf

  • /etc/containers/storage.conf
  • $HOME/.config/containers/storage.conf

storage.conf is the storage configuration file for all tools using containers/storage. It specifies all of the available container storage options for tools using shared container storage.

When Podman runs in rootless mode, $HOME/.config/containers/storage.conf is used instead of the system defaults.

If the CONTAINERS_STORAGE_CONF environment variable is set, then its value is used for the storage.conf file rather than the default.

🌸 Rootless mode 🌸

Podman can also be used as non-root user, and honestly? Iconic. When podman runs in rootless mode, a user namespace is automatically created for the user, defined in /etc/subuid and /etc/subgid.

Containers created by a non-root user are not visible to other users and are not seen or managed by Podman running as root. Your containers, your business. 🫶

⚠️ It is required to have multiple UIDS/GIDS set for a user. Be sure the user is present in the files /etc/subuid and /etc/subgid.

Execute the following commands to add the ranges to the files:

$ sudo usermod --add-subuids 10000-75535 USERNAME
$ sudo usermod --add-subgids 10000-75535 USERNAME

Or just add the content manually:

$ echo USERNAME:10000:65536 >> /etc/subuid
$ echo USERNAME:10000:65536 >> /etc/subgid

See the subuid(5) and subgid(5) man pages for more information.

🙈 Note: whitespace in any row of /etc/subuid or /etc/subgid, including trailing blanks, may result in no entry failures. So don't be cute with your spaces, bestie. 💀

Images are pulled under XDG_DATA_HOME when specified, otherwise in the home directory of the user under .local/share/containers/storage.

Currently pasta is required to be installed to create a network device, otherwise rootless containers need to run in the network namespace of the host.

In certain environments like HPC (High Performance Computing), users cannot take advantage of the additional UIDs and GIDs from the /etc/subuid and /etc/subgid systems. However, in this environment, rootless Podman can operate with a single UID. To make this work, set the ignore_chown_errors option in the containers-storage.conf(5) file. This option tells Podman when pulling an image to ignore chown errors when attempting to change a file in a container image to match the non-root UID in the image. This means all files get saved as the user's UID. Note this can cause issues when running the container. 😬 Lowkey a tradeoff, highkey worth knowing.

🦋 NOTE: Unsupported file systems in rootless mode

The Overlay file system (OverlayFS) is not supported with kernels prior to 5.12.9 in rootless mode. The fuse-overlayfs package is a tool that provides the functionality of OverlayFS in user namespace that allows mounting file systems in rootless environments. It is recommended to install the fuse-overlayfs package.

In rootless mode, Podman automatically uses the fuse-overlayfs program as the mount_program if installed, as long as the $HOME/.config/containers/storage.conf file was not previously created. If storage.conf exists in the homedir, add mount_program = "/usr/bin/fuse-overlayfs" under [storage.options.overlay] to enable this feature. Little manual step, no biggie. ✨

The Network File System (NFS) and other distributed file systems (for example: Lustre, Spectrum Scale, the General Parallel File System (GPFS)) are not supported when running in rootless mode as these file systems do not understand user namespace. However, rootless Podman can make use of an NFS Homedir by modifying the $HOME/.config/containers/storage.conf to have the graphroot option point to a directory stored on local (Non NFS) storage. Problem solved, we move. 🧚

✨ SEE ALSO ✨

Go read these, they're all serving:

🔍 Troubleshooting

🎀 HISTORY 🎀

Dec 2016, Originally compiled by Dan Walsh dwalsh@redhat.com — a whole legend. 👑

And that's a wrap on the podman(1) man page, bestie!! 🎉 The footer is literally just the podman(1) source/version and date stamp chilling at the bottom — that's the official seal, periodt. Now go run some containers, slay, and remember: rootless is a lifestyle. 💜🦋🌸

📦 where this page comes from