s0sta
EN NL عربي
الفلاتر
طريقة البحث
  • الكلمات العادية تجد الأسماء والنصوص والأمثلة.
  • "كلمتان" تجد العبارة بالضبط.
  • --name أو -x تجد خيارًا.
  • #كلمة تبحث داخل الأوامر فقط.
  • @grep تجد الدروس والمعامل التي تستخدم grep.
  • الفلاتر: cat:network · in:labs · level:rhcsa · ch:8 · root:yes. ضع ! قبل كلمة لاستبعادها. OR بين الكلمات تعني إحداها.
  • ↑ ↓ للتنقل · Enter للفتح · Esc للإغلاق · / للبحث

podman

Run and manage containers, images, volumes and pods — without a daemon, and also as a normal user (rootless).

المستوى
إضافي
المجموعة
العمليات والمهام
يحتاج root
لا
الحزمة
podman
يُسمّى أيضًا
podman-run, podman-build

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

ماذا يفعل

Podman is the container engine of RHEL. The commands are the same as Docker's (alias docker=podman works for most scripts), but there is no background service: every container is a normal child process, and a normal user can run containers in his own user namespace.

Images come from registries (registry.access.redhat.com, registry.redhat.io, quay.io …). Use full image names. Data that must stay goes into volumes or host folders mounted with -v DIR:DIR:Z (the :Z gives the folder the right SELinux label). To start containers at boot, write a Quadlet file (.container) for systemd. Each sub-command has its own man page: man podman-run, man podman-build …

طريقة الكتابة

podman [GLOBAL OPTION]... COMMAND [OPTION]... [ARG]...
podman run [OPTION]... IMAGE [COMMAND [ARG]...]
podman build [OPTION]... [CONTEXT]

الأجزاء الرئيسية

Containers

run IMAGE [CMD]
Create and start a new container from an image.
create IMAGE
Create a container but do not start it.
start / stop / restart NAME
Start, stop or restart containers.
ps
List containers (-a also stopped ones).
logs NAME
Show the output (logs) of a container.
exec NAME CMD
Run a command inside a running container.
attach NAME
Connect to the main process of a container.
top NAME
Show the processes inside a container.
stats
Live CPU, memory and network use of containers.
inspect NAME
All details of a container (or image, volume, network) as JSON.
port NAME
Show the published ports.
cp SRC DST
Copy files between a container and the host.
diff NAME
Files changed in a container.
kill NAME
Send a signal to the main process.
pause / unpause NAME
Freeze / continue all processes.
rename OLD NEW
Rename a container.
rm NAME
Remove containers (-f also running ones).
wait NAME
Wait until a container stops, print its exit code.
commit NAME IMAGE
Make a new image from a changed container.
export NAME
Save the file system of a container as a tar archive.
healthcheck run NAME
Run the health check of a container now.
update NAME
Change CPU and memory limits of a container.
container prune
Remove all stopped containers.

Images

images
List local images.
pull IMAGE
Download an image.
push IMAGE [DEST]
Upload an image to a registry.
build [DIR]
Build an image from a Containerfile.
search TERM
Search a registry.
tag IMAGE NEWNAME
Give an image another name.
untag IMAGE
Remove names from an image.
rmi IMAGE
Remove local images.
history IMAGE
Show the layers of an image.
save / load
Write images to a tar archive / read them back.
import FILE
Make an image from a tar archive.
image prune
Remove images that no container uses.
login / logout REGISTRY
Log in to / out of a registry.
manifest
Work with multi-architecture image lists.

Storage, network and pods

volume create/ls/inspect/rm/prune
Manage named volumes.
network create/ls/inspect/rm/connect
Manage container networks.
secret create/ls/rm
Store passwords and keys for containers.
pod create/ps/start/stop/rm
Groups of containers that share a network.
kube play FILE
Run containers and pods from a Kubernetes YAML file.
kube generate NAME
Write Kubernetes YAML for a container or pod.

System

info
Information about the host, storage and registries.
version
The Podman version.
system df
Disk space used by images, containers and volumes.
system prune
Remove everything that is not used.
system reset
Delete all containers, images and volumes of this user.
system migrate
Move containers to a new Podman version (rootless).
events
Show container events live.
auto-update
Pull newer images and restart containers that use the auto-update label.
generate systemd NAME
Write a systemd unit (deprecated: use Quadlet).
unshare CMD
Run a command inside the user namespace of rootless Podman.
mount / unmount NAME
Mount the file system of a container (root or podman unshare).
machine
Manage the Podman virtual machine (macOS and Windows).
completion SHELL
Make shell completion scripts.

الخيارات 138

الأكثر استخدامًا

Global options

--cgroup-manager=MANAGER
Use systemd (default) or cgroupfs for container cgroups.
--conmon=PATH
Path of the conmon program.
-c, --connection=NAME
Use a saved connection to a remote Podman.
--events-backend=TYPE
Store events in journald, a file, or none.
-h, --help
Show help.
--hooks-dir=PATH
Folder with OCI hook files.
--identity=PATH
SSH key for a remote connection.
--imagestore=PATH
Extra place to store images.
--log-level=LEVEL
Log level: debug, info, warn, error …
--module=PATH
Load an extra containers.conf file.
--network-cmd-path=PATH
Path of the rootless network program.
--network-config-dir=DIR
Folder of the network config files.
--out=PATH
Write the normal output to a file.
-r, --remote
Talk to a Podman service instead of running locally.
--root=DIR
Folder of the container storage.
--runroot=DIR
Folder of the run-time state.
--runtime=PATH
The OCI runtime (crun, runc).
--runtime-flag=FLAG
Pass a flag to the runtime.
--ssh=MODE
SSH mode for remote connections.
--storage-driver=DRIVER
Storage driver (overlay, vfs).
--storage-opt=OPT
Extra storage driver option.
--syslog
Also log to syslog.
--tmpdir=PATH
Folder for temporary state.
--transient-store
Keep container state only in memory.
--url=URL
Address of a remote Podman service.
-v, --version
Show the version.
--volumepath=PATH
Folder of named volumes.

podman run / create: start and identity

-d, --detach
Run in the background and print the container ID.
-i, --interactive
Keep the input open.
-t, --tty
Give the container a terminal (use with -i).
--name=NAME
Name of the container.
--rm
Remove the container when it stops.
--replace
Replace an existing container with the same name.
--restart=POLICY
Restart policy: no, on-failure[:N], always, unless-stopped.
--entrypoint=CMD
Replace the entry point of the image.
-w, --workdir=DIR
Working folder inside the container.
-u, --user=USER[:GROUP]
Run as this user inside the container.
--hostname=NAME
Host name inside the container.
--pull=POLICY
When to pull: always, missing (default), never, newer.
--init
Run a small init that reaps zombie processes.
--systemd=true|false|always
Run systemd inside the container.
--pod=NAME
Run the container inside a pod.
--requires=NAME
Start these containers first.
--sdnotify=MODE
How the container tells systemd it is ready.
--stop-signal=SIGNAL
Signal to stop the container.
--stop-timeout=SECONDS
Seconds to wait before it is killed.
--timeout=SECONDS
Kill the container after this time.
-a, --attach=STREAM
Attach to stdin, stdout or stderr.
--detach-keys=KEYS
Keys to detach from a container.
--sig-proxy
Pass signals to the container (default on).
--cidfile=FILE
Write the container ID to a file.
--pidfile=FILE
Write the PID of the container to a file.

podman run / create: environment and files

-e, --env=VAR=VALUE
Set an environment variable.
--env-file=FILE
Read variables from a file.
--env-host
Use all variables of the host.
--unsetenv=VAR / --unsetenv-all
Remove variables of the image.
-v, --volume=SRC:DST[:OPTS]
Mount a host folder or a named volume. Options: ro, Z, z, U.
--mount=type=TYPE, ...
Long form of a mount (bind, volume, tmpfs, image).
--tmpfs=DIR
Mount a memory file system.
--volumes-from=NAME
Use the volumes of another container.
--read-only
Make the container's root file system read-only.
--read-only-tmpfs
With --read-only, keep /tmp and /run writable.
--secret=NAME[,opts]
Give a Podman secret to the container (file or variable).
--label=KEY=VALUE / --label-file=FILE
Add labels.
--annotation=KEY=VALUE
Add an annotation.
--tz=ZONE
Time zone of the container.
--umask=UMASK
umask inside the container.
--passwd / --passwd-entry=ENTRY
Add the user to /etc/passwd of the container.
--group-add=GROUP
Extra groups (keep-groups keeps the user's groups).
--image-volume=MODE
What to do with volumes in the image: bind, tmpfs, ignore.

podman run / create: network and ports

-p, --publish=[IP:]HOSTPORT:PORT[/PROTO]
Publish a container port on the host.
-P, --publish-all
Publish all exposed ports on random host ports.
--expose=PORT
Declare a port (does not publish it).
--network=MODE
bridge, a named network, host, none, pasta (rootless default), container:NAME.
--network-alias=NAME
Extra name on the network.
--ip=ADDR / --ip6=ADDR
Fixed address on a network.
--mac-address=ADDR
Fixed MAC address.
--add-host=NAME:IP
Add a line to /etc/hosts of the container.
--no-hosts
Do not write /etc/hosts.
--http-proxy
Pass the proxy variables of the host (default on).

podman run / create: limits and security

-m, --memory=SIZE
Memory limit (512m, 2g).
--memory-reservation=SIZE / --memory-swap=SIZE / --memory-swappiness=N
More memory settings.
--cpus=N
Number of CPUs the container may use (1.5).
--cpu-shares=N / --cpu-period / --cpu-quota
CPU weight and quota.
--cpuset-cpus=LIST / --cpuset-mems=LIST
Use only these CPUs / memory nodes.
--pids-limit=N
Maximum number of processes.
--ulimit=TYPE=SOFT[:HARD]
Resource limits (nofile=1024:2048).
--shm-size=SIZE
Size of /dev/shm.
--blkio-weight=N / --device-read-bps / --device-write-bps …
Disk I/O limits.
--oom-kill-disable / --oom-score-adj=N
Out-of-memory behaviour.
--privileged
Give almost all host rights. Avoid it.
--cap-add=CAP / --cap-drop=CAP
Add or remove Linux capabilities.
--security-opt=OPT
SELinux label, seccomp, no-new-privileges …
--device=HOSTDEV[:DEV][:PERM]
Give a host device to the container.
--userns=MODE
User namespace: keep-id, auto, host, nomap.
--uidmap / --gidmap / --subuidname / --subgidname
Custom ID mapping.
--pid=MODE / --ipc=MODE / --uts=MODE / --cgroupns=MODE
Share namespaces with the host or a container.
--sysctl=NAME=VALUE
Kernel settings inside the container.
--health-cmd=CMD
A health check command (with --health-interval, --health-retries, --health-timeout, --health-start-period, --health-on-failure).
--no-healthcheck
Turn off the health check of the image.
--log-driver=DRIVER / --log-opt=OPT
Where the logs go (journald, k8s-file, none).
--arch / --os / --platform / --variant
Choose the image for another architecture.

podman ps

-a, --all
Also stopped containers.
-f, --filter=FILTER
Filter: status=exited, name=web, label=…, ancestor=IMAGE.
--format=FORMAT
Go template output ({{.Names}} {{.Status}}) or json.
-q, --quiet
Only the IDs.
-n, --last=N / -l, --latest
The last N / the last created container.
--no-trunc / --noheading / -s, --size / --sort=FIELD / -p, --pod / --ns / --external / -w, --watch
More output choices.

podman logs

-f, --follow
Follow new lines.
--tail=N
Only the last N lines.
--since=TIME / --until=TIME
Time range (10m, 2026-10-27T08:00).
-t, --timestamps
Show time stamps.
-n, --names / --color / -l, --latest
More output choices.

podman exec

-i, --interactive / -t, --tty
Interactive shell (-it).
-u, --user=USER
Run as this user.
-e, --env=VAR=VALUE / --env-file=FILE
Set variables.
-w, --workdir=DIR
Working folder.
-d, --detach / --detach-keys / --privileged / --preserve-fds=N / -l, --latest
More choices.

podman images

-a, --all
Also intermediate images.
-q, --quiet
Only the IDs.
-f, --filter=FILTER
dangling=true, reference=NAME, before=, since=, label=.
--format=FORMAT / --digests / --history / --no-trunc / -n, --noheading / --sort=FIELD
Output choices.

podman build

-t, --tag=NAME
Name of the new image.
-f, --file=FILE
Use this Containerfile (default Containerfile or Dockerfile).
--build-arg=ARG=VALUE / --build-arg-file=FILE
Values for ARG lines.
--no-cache
Do not use cached layers.
--pull=POLICY
When to pull the base image.
--layers
Cache the layers (default on).
--squash / --squash-all
Make fewer layers / one layer.
--target=STAGE
Build only up to this stage of a multi-stage file.
--platform=OS/ARCH / --arch / --os
Build for another platform.
--label=KEY=VALUE / --annotation=KEY=VALUE
Add labels and annotations.
--secret=id=ID, src=FILE
Give a secret to RUN steps without saving it in the image.
-v, --volume=SRC:DST
Mount a host folder during the build.
--network=MODE / --add-host / --dns …
Network during the build.
--format=oci|docker
Image format.
-q, --quiet / --logfile=FILE / --iidfile=FILE / --rm / --force-rm / --jobs=N / --retry=N / --tls-verify / --authfile=FILE / --creds=USER:PASS
More choices (see man podman-build).

أمثلة 14

$ مستخدم عادي# بصلاحية root (أو مع sudo)

  1. 1Check that rootless Podman works

    podman info --format '{{.Host.Security.Rootless}} {{.Store.GraphRoot}}'
true /home/student/.local/share/containers/storage

    Rootless containers and images live in your home folder, not in /var/lib/containers.

  2. 2Look at an image before you pull it

    skopeo inspect docker://registry.access.redhat.com/ubi10/httpd-24 --format '{{.Labels.summary}}'
podman pull registry.access.redhat.com/ubi10/httpd-24

    Always use the full name: registry, namespace, image, tag.

  3. 3Run a web server with your own content

    mkdir -p ~/site && echo "hello" > ~/site/index.html
podman run -d --name site -p 8080:8080 -v ~/site:/var/www/html:Z registry.access.redhat.com/ubi10/httpd-24
curl -s http://localhost:8080/
hello

    :Z labels the folder for this container. Without it, SELinux blocks access.

  4. 4Get a shell in a running container

    podman exec -it site /bin/bash
bash-5.2$ cat /etc/os-release | head -2

    Leave the shell with exit; the container keeps running.

  5. 5Read the logs of a container

    podman logs --tail 20 -f site
podman logs --since 10m site

  6. 6Run a one-time command and delete the container

    podman run --rm registry.access.redhat.com/ubi10/ubi cat /etc/redhat-release
Red Hat Enterprise Linux release 10.0 (Coughlan)

  7. 7Find and clean up stopped containers and old images

    podman ps -a --filter status=exited --format '{{.Names}} {{.Status}}'
podman container prune -f
podman image prune -f
podman system df

  8. 8Build and push your own image

    cat Containerfile
FROM registry.access.redhat.com/ubi10/httpd-24
COPY index.html /var/www/html/
podman build -t quay.io/s0sta/site:1.0 .
podman login quay.io
podman push quay.io/s0sta/site:1.0

  9. 9Limit memory and CPU of a container

    podman run -d --name worker --memory 512m --cpus 1 --pids-limit 200 registry.access.redhat.com/ubi10/ubi sleep infinity
podman stats --no-stream worker

  10. 10Run a container with fewer rights (DevSecOps)

    podman run --rm --read-only --cap-drop=ALL --security-opt no-new-privileges -u 1001 registry.access.redhat.com/ubi10/ubi id
uid=1001(1001) gid=0(root) groups=0(root)

    Read-only root, no capabilities, no privilege change: a hacked app can do much less.

  11. 11Keep data in a named volume

    podman volume create pgdata
podman run -d --name db -v pgdata:/var/lib/pgsql/data:Z -e POSTGRESQL_USER=app -e POSTGRESQL_PASSWORD=secret -e POSTGRESQL_DATABASE=app registry.redhat.io/rhel10/postgresql-16
podman volume inspect pgdata --format '{{.Mountpoint}}'

  12. 12Start a container at boot with Quadlet

    mkdir -p ~/.config/containers/systemd
cat ~/.config/containers/systemd/site.container
[Container]
Image=registry.access.redhat.com/ubi10/httpd-24
PublishPort=8080:8080
Volume=%h/site:/var/www/html:Z
[Install]
WantedBy=default.target
systemctl --user daemon-reload
systemctl --user start site.service
loginctl enable-linger student

    Linger keeps the user's services running without a login and after a reboot.

  13. 13Copy a file out of a container

    podman cp site:/etc/httpd/conf/httpd.conf ./httpd.conf
podman diff site | head

  14. 14Run a Kubernetes YAML file

    podman kube generate site > site.yaml
podman kube play site.yaml
podman kube down site.yaml

انتبه

  • Rootless containers can not bind host ports below 1024. Use 8080 / 8443, or a firewalld port forward.
  • --privileged and -v /:/host give a container almost full control of the host. Avoid them.
  • A container's own file system is deleted with podman rm. Keep data in volumes or host folders.
  • podman generate systemd is deprecated. Use Quadlet files.
  • Images from registry.redhat.io need podman login with a Red Hat account; UBI images from registry.access.redhat.com do not.

الملفات

/etc/containers/registries.conf
Registries and the search list for short names.
/etc/containers/containers.conf, ~/.config/containers/containers.conf
Defaults of Podman.
/etc/containers/storage.conf
Storage driver and places.
~/.config/containers/systemd/, /etc/containers/systemd/
Quadlet files (user / root).
/etc/subuid, /etc/subgid
ID ranges for rootless containers.
$XDG_RUNTIME_DIR/containers/auth.json
Saved registry logins.

نصائح للحفظ

  • podman ps --format '{{.Names}} {{.Ports}}' gives a short, script-friendly list.
  • podman auto-update with the label io.containers.autoupdate=registry updates Quadlet containers when a new image is pushed.
  • podman unshare ls -l ~/.local/share/containers shows files with the IDs the containers see.

رموز الخروج

0Success.
125Error in Podman itself.
126The command in the container could not be run.
127The command in the container was not found.
Otherpodman run returns the exit code of the container's main process.

الدليل الكامل

هذه الصفحة تشرح الأمر بكلمات بسيطة. الدليل الأصلي فيه كل التفاصيل.

في الطرفية: man podman

افتح صفحة man (linux.die.net)docs.podman.io