Hi all, Podman candidate v6.2.0-rc1 is now available. You may view the full details at https://github.com/podman-container-tools/podman/releases/tag/v6.2.0-rc1 Release candidate Notes: -------------- ### Features - The `podman push` command now supports a new option, `--platform`, which selects and pushes a single platform-specific manifest instead of the entire list. - The `podman kube play` command now supports a new option, `--validate`, which determines how unrecognized YAML fields are handled ([#18332](https://github.com/podman-container-tools/podman/issues/18332)). - The `podman kube play` command now supports a new option, `--label`, to set labels on created containers, pods, volumes, and secrets ([#26450](https://github.com/podman-container-tools/podman/issues/26450)). - The `podman kube play` command can now create multiple pods if more than 1 replica is requested by a deployment using the new `--multiple-pods` option ([#26769](https://github.com/podman-container-tools/podman/issues/26769)). - The `podman kube play --build` command now supports building images from subdirectories of the main context directory ([#28148](https://github.com/podman-container-tools/podman/issues/28418)). - Quadlet `.container` files now support a new key, `Umask`, to set the default umask for the created container ([#25278](https://github.com/podman-container-tools/podman/issues/25278)). - All Quadlet files now support a new key, `SetMountsDependency`, configuring whether the generated unit will use `RequiresMountsFor`, `WantsMountsFor`, or no dependency at all on required source paths ([#29946](https://github.com/podman-container-tools/podman/issues/29946)). - The `podman farm list` command now supports two new options, `--quiet`, which will print only the names of active farms, and `--noheading`, which omits column headers from the output. - The `podman artifact ls` command now supports two new options, `--format=json`, which will output machine-readable JSON, and `--quiet`, which prints only artifact digests. - The `podman create` command now supports a new option, `--passwd`, to add entries to `/etc/passwd` in the container (this has previously been available with `podman run`). - The `podman info` command now includes detailed information on the features supported by OCI runtimes. - The `podman events --filter` command now supports a new filter, `network=`, to filter to events pertaining to a specific network ([#29387](https://github.com/podman-container-tools/podman/issues/29387)). - The `podman auto-update` command has been enabled on the remote Podman client. - The `StartInterval` field in image healthcheck configuration is now respected, allowing images to configure startup healthchecks ([#27724](https://github.com/podman-container-tools/podman/issues/27724)). - The `podman image scp` command now supports two new options, `--compression-format` and `--compression-level`, to compress data during transfer ([#23192](https://github.com/podman-container-tools/podman/issues/23192)). - The `podman auto-update` command now supports a new option, `--filter`, to selectively update only containers that match the given filters. - The `podman ps --sort` command now allows sorting by pod. - The `podman ps --filter` command now supports a new filter, `status!`, which matches containers not in the given state ([#21398](https://github.com/podman-container-tools/podman/issues/21398)). ### Changes - Podman now requires Go v1.26 or higher to build. - The `podman kube play` command now uses the `securityContext.seccompProfile` fields in Kubernetes YAML for Seccomp configuration. Support for the existing annotation-based configuration of Seccomp is now deprecated, and will be removed with Podman 7.0. - The `podman inspect` command on containers now includes three new fields, `DNSNames` (containing all names the container can be accessed via), `IsInitCtr` (whether the container is an init container), and `InitContainerType` (what type of init container this is, if it is one) ([#29811](https://github.com/podman-container-tools/podman/issues/29811)). - The `podman inspect` command on containers now only includes user-added DNS aliases in the `Aliases` field, which previously displayed all DNS aliases, improving Docker compatibility. - The `podman inspect` command on containers now properly populates the `ConsoleSize` field for running containers ([#28368](https://github.com/podman-container-tools/podman/issues/28368)). - Systemd units created by Podman healthchecks are now named much more clearly (`libpod-healthcheck-$CONTAINERID-$randsuffix.service`) ([#29373](https://github.com/podman-container-tools/podman/issues/29373)). - Signal proxying is now enabled for attached `podman exec` commands. As such, killing a `podman exec` command with Control-C or similar should now also kill the processes started in the container (similar to how `podman run` already works) ([#19486](https://github.com/podman-container-tools/podman/issues/19486)). - The deprecated `--cpu-rt-period` and `--cpu-rt-runtime` options for `podman create`, `podman run`, `podman update`, and `podman container clone` are now hidden and undocumented. They have not been functional since the removal of cgroups v1 support and will be removed entirely in Podman v7. - The `--health-startup-interval` option to `podman create`, `podman run`, and `podman update` has a new alias, `--health-start-interval`. - When a startup healthcheck interval is specified, but no startup healthcheck command, the standard healthcheck command will be used instead. - When using the `journald` event driver, timestamps are no longer included in logged events, as `journald` includes a timestamp already ([#29835](https://github.com/podman-container-tools/podman/issues/29835)). - Quadlet can now create template instances from instance-specific drop-in directories without requiring an explicit instance file or symlink ([#27636](https://github.com/podman-container-tools/podman/issues/27636)). ### Bugfixes - Fixed a bug where passing an empty file to the `--ignorefile` option to `podman build` would cause the `.dockerignore` or `.containerignore` file in the context directory to be used, instead of not using an ignorefile at all ([#25147](https://github.com/podman-container-tools/podman/issues/25147)). - Fixed a bug where the `Pod=` key in Quadlet `.container` files did not expand the `%N` specifier ([#29108](https://github.com/podman-container-tools/podman/issues/29108)). - Fixed a bug where containers created with `--userns=auto` would report having a `private` user namespace in `podman inspect` after they started, but not when they were first created. - Fixed a bug where logging was configured too late in the Podman init process to print errors from parsing configuration files ([#25362](https://github.com/podman-container-tools/podman/issues/25362)). - Fixed a bug where the `podman system prune --build` command could fail if a build container was removed while it was running. - Fixed a bug where `copy` events from `podman machine cp` were not properly displayed by the remote Podman client. - Fixed a bug where the `podman farm build --tag` command would fail if given a tag including a colon ([#25039](https://github.com/podman-container-tools/podman/issues/25039)). - Fixed a bug where the `podman machine init --image` command would fail when given a read-only disk image. - Fixed a bug where the `podman machine start` and `podman machine init --now` commands could hang on Windows systems using the Hyper-V provider if the VM failed to start ([#29455](https://github.com/podman-container-tools/podman/issues/29455)). - Fixed a bug where the `podman machine start` command on Windows (both Hyper-V and WSL providers) would sometimes fail due to leftover processes from previous machines ([#29474](https://github.com/podman-container-tools/podman/issues/29474)). - Fixed a bug where the `podman machine start` command could hang indefinitely if the VM failed to start properly ([#29880](https://github.com/podman-container-tools/podman/issues/29880)). - Fixed a bug where the `podman machine start` command could create a VM that cannot be connected to on Windows if the host was shut down or restarted when the VM was running ([#29971](https://github.com/podman-container-tools/podman/issues/29971)). - Fixed a bug where the `podman machine init` command on Windows when using the Hyper-V provider did not correctly detach the file server process, causing VMs to lose access to host shares when the console that ran `podman machine init` closed ([#29573](http://github.com/podman-container-tools/podman/issues/29573)). - Fixed a bug where the `podman kube play` command incorrectly handled `emptyDir` volumes with `medium: Memory`, causing them to not be shared between containers in the pod and to ignore the `sizeLimit` parameter ([#29555](https://github.com/podman-container-tools/podman/issues/29555)). - Fixed a bug where the remote Podman client's `podman kube play` command incorrectly handled authentication credentials in API requests. - Fixed a bug where volumes created by the `podman volume import` command would not adjust their permissions on being mounted into a container ([#25442](https://github.com/podman-container-tools/podman/issues/25442)). - Fixed a bug where the `podman build` command could leak temporary directories if a build failed ([#22642](https://github.com/podman-container-tools/podman/issues/22642)). - Fixed a bug where containers created with `--userns=keep-id` would use an image-specified user instead of forcing the same UID/GID in use on the host ([#29600](https://github.com/podman-container-tools/podman/issues/29600)). - Fixed a bug where the remote Podman client could not function when connecting over SSH to a server which does not support the direct-streamlocal channel type ([#27814](https://github.com/podman-container-tools/podman/issues/27814)). - Fixed a bug where the remote Podman client's `podman push`, `podman artifact push`, and `podman manifest push` commands would push an unsigned image instead of failing when the `--sign-by` or `--sign-by-sigstore-private-key` options were used. - Fixed a bug where creating a container with `--userns=auto` that had overlay volume mounts would fail ([#28758](https://github.com/podman-container-tools/podman/issues/28758)). - Fixed a bug where volume subpaths including a `=` character in the path were handled incorrectly. - Fixed a bug where the remote Podman client was unable to add subjects to artifacts with the `podman manifest annotate --subject` and `podman manifest add --artifact subject` commands. - Fixed a bug where the remote Podman client's `podman manifest add --artifact` command could hang under some circumstances. - Fixed a bug where the `podman manifest annotate --os-features` command did not properly save the OS features in the manifest. - Fixed a bug where the remote Podman client's `podman image prune --filter` did not correctly handle filters with values including the `=` character. - Fixed a bug where Quadlet `.volume` units did not recreate the volume if it was removed in Podman ([#27862](https://github.com/podman-container-tools/podman/issues/27862)). - Fixed a bug where containers with a failing startup healthcheck would not immediately transition to unhealthy when the startup period ended. - Fixed a bug where containers started with `--sdnotify=healthy` and a `HealthStartPeriod` longer than the unit's `TimeoutStartSec` could be automatically killed by systemd if the healthcheck took an extended period to become healthy ([#27290](https://github.com/podman-container-tools/podman/issues/27290)). - Fixed a bug where the `--pids-limit=0` argument to `podman run` and `podman create` was incorrectly setting a process limit, instead of removing the limit, when the `runc` OCI runtime was in use ([#29826](https://github.com/podman-container-tools/podman/issues/29826)). - Fixed a bug where Quadlet did not search the parent directory of symlinked unit files for drop-in configuration files, which broke using Quadlets defined by root as a rootless user if drop-in overrides were in use ([#29821](https://github.com/podman-container-tools/podman/issues/29821)). - Fixed a bug where the `podman ps` and `podman pod ps` commands would fail when the `--format` argument was used with a format string including `.Label` ([#29831](https://github.com/podman-container-tools/podman/issues/29831)). - Fixed a bug where the `podman cp` command did not respect volume subpaths when copying into a mounted named or image volumes in a container that is not running ([#29840](https://github.com/podman-container-tools/podman/issues/29840) and [#29857](https://github.com/podman-container-tools/podman/issues/29857)). - Fixed a bug where volume plugins were initialized when they were not required, which could cause early-boot containers started by Quadlet to error on missing plugins that the container was not actually using ([#28110](https://github.com/podman-container-tools/podman/issues/28110)). - Fixed a bug where the `podman export` command, when run by a rootless user on a container created with `--userns=keep-id`, would create an archive with incorrect UIDs and GIDs ([#29856](https://github.com/podman-container-tools/podman/issues/29856)). - Fixed a bug where the `podman system service` command would fail to start when run as a systemd unit and autostarted at the same time as other Podman units ([#29964](https://github.com/podman-container-tools/podman/issues/29964)). - Fixed a bug where the `podman events` command would return incomplete output when using the `file` events backend and `--until` specified with a time in the past ([#29579](https://github.com/podman-container-tools/podman/issues/29579)). - Fixed a bug where the `podman update` command allowed setting a startup healthcheck on a container without a normal healthcheck. - Fixed a bug where the remote Podman client's `podman secret rm` command would fail when given an ambiguous name that could match multiple possible secrets. - Fixed a bug where the `podman machine info` command would report the default VM type and config/image directories, not those used by the current machine. - Fixed a bug where the `podman inspect` command on containers did not include `CheckpointLog` after a failed container checkpoint ([#25154](https://github.com/podman-container-tools/podman/issues/25154)). ### API - The Libpod API now features a new endpoint, `POST /libpod/autoupdate`, which automatically updates containers with the `io.containers.autoupdate` label. - The Compat API now features a new endpoint, `GET /distribution/{name}/json`, which inspects an image on a registry ([#17726](https://github.com/podman-container-tools/podman/issues/17726)). - The Compat Create endpoint for Containers now supports a new field, `HostConfig.Mounts.TmpfsOptions.Options`, to set additional options for tmpfs mounts. - The Compat Create endpoint for Containers now allows a full Seccomp profile to be passed in the `HostConfig.SecurityOpt` field (instead of a path to a file containing a profile), improving Docker compatibility ([#27710](https://github.com/podman-container-tools/podman/issues/27710)). - The Compat Push endpoint for Images now supports a new query parameter, `platform`, to push only a single platform-specific manifest instead of the entire list. - The Compat Info endpoint now includes the status of active OCI runtimes. - Fixed a bug where the Libpod Create endpoint for Containers required that the `auto` userns mode also specify full UID/GID mappings for the created container. - Fixed a bug where the Compat Create endpoint for Containers would incorrectly adjust mode when setting tmpfs size. - Fixed a bug where the Compat Create endpoint for Containers would incorrectly treat a healthcheck of `{}` as the user explicitly requesting no healthcheck, instead of using the image's healthcheck as Docker does ([#29467](https://github.com/podman-container-tools/podman/issues/29467)). - Fixed a bug where the Compat Inspect endpoint for Secrets allowed the `showsecret` query parameter, which should be restricted to Libpod API requests only ([#29570](https://github.com/podman-container-tools/podman/issues/29570)). - Fixed a bug where the Compat Inspect endpoint for Images included the `Created` field even when it was empty. - Fixed a bug where the Compat List and Inspect endpoints for Networks did not include `IPRange` in the returned `IPAMConfig` ([#28378](https://github.com/podman-container-tools/podman/issues/28378)). - Fixed a bug where the Compat List endpoint for Containers would error when passed a filter including container statuses supported by Docker but not Podman (`dead` and `restarting`) ([#28904](https://github.com/podman-container-tools/podman/issues/28904)). - Fixed a bug where the Compat Stats endpoint for Containers could panic on containers with a memory reservation, but no memory limit, set ([#29627](https://github.com/podman-container-tools/podman/issues/29627)). - Fixed a bug where the Compat Stats endpoint for Containers incorrectly populated `system_cpu_usage` and `percpu_stats` when not streaming ([#28761](https://github.com/podman-container-tools/podman/issues/28761), [#24730](https://github.com/podman-container-tools/podman/issues/24730), [#25709](https://github.com/podman-container-tools/podman/issues/25709), [#29912](https://github.com/podman-container-tools/podman/issues/29912)). - Fixed a bug where the Compat Info endpoint reported an incorrect cgroup manager when running rootless with the `cgroupfs` cgroup manager ([#27824](https://github.com/podman-container-tools/podman/issues/27824)). - Fixed a bug where the Compat and Libpod Attach endpoints for Containers would, when doing a logs-only (`stream=0` and `logs=1`) attach, incorrectly reinitialize the container, changing its exit code and status ([#29664](https://github.com/podman-container-tools/podman/issues/29664 )). - Fixed a bug where the Compat and Libpod Update endpoints would incorrectly clear a container's restart policy when it was omitted from the request ([#29790](https://github.com/podman-container-tools/podman/issues/29790)). - Fixed a bug where the Compat and Libpod Start endpoints for Exec sessions would return an error when trying to start an exec session with no standard streams attached without specifying `Detach=true`. - Fixed a bug where the Libpod Generate Kube endpoint returned the wrong content type ([#29674](https://github.com/podman-container-tools/podman/issues/29674)). - Numerous fixes to the API's Swagger documentation have been made to ensure it accurately documents the REST API. ### Misc - Fixed a number of low-level resource leaks in various parts of Podman. - Waiting for `gvproxy` to start when starting a `podman machine` VM now uses a notification socket, instead of polling, improving reliability and startup time. - Updated documentation for the `--image-volume` option to `podman create` and `podman run` to remove the deprecated `bind` option and add the new default, `anonymous`, which was not shown as a valid option. Using the deprecated `bind` option now prints a warning.