发布日期: 2024-03-19
版本号: v5.0.0

Podman 5.0.0版本包含多项重要更新。安全方面修复了CVE-2024-1753漏洞，该漏洞在禁用SELinux时可能允许用户向主机根目录写入文件。新增功能包括：MacOS支持使用原生Apple虚拟化技术创建虚拟机；新增podman machine reset命令用于重置所有虚拟机配置；podman manifest add支持添加OCI构件；多项命令新增--retry重试选项及--preserve-fd文件描述符传递功能；Quadlet新增支持模板化单元、Pod创建及健康检查通知等功能。破坏性变更包括：虚拟机配置格式不兼容旧版需重新创建；停止支持QEMU改用Apple虚拟化；数据库默认切换至SQLite；弃用CNI网络改用cgroups v2；根默认网络工具改为pasta；多项CLI参数解析规则调整。其他改进包含网络统计信息优化、podman system reset行为变更及环境变量传递优化。修复了podman stats网络统计显示异常、容器OOM状态标记错误等多项问题。API新增镜像解析端点并优化过滤器处理。底层依赖库如Buildah、containers/image等均有版本升级。

更新内容 （中文）

5.0.0

安全

  • 修复了 Buildah 和 podman build 中的 CVE-2024-1753，该漏洞允许用户在未启用 selinux 时向宿主机的 / 目录写入文件。

新功能

  • podman machine 创建的虚拟机现可在 macOS 上使用原生 Apple 虚拟化框架（applehv）
  • 新增 podman machine reset 命令用于移除所有现有 podman machine 虚拟机及相关配置
  • podman manifest add 命令新增 --artifact 选项以支持向清单列表添加 OCI 工件
  • podman create、podman run 和 podman push 命令现支持 --retry 和 --retry-delay 选项来配置镜像推送/拉取的重试机制
  • podman run 和 podman exec 新增 --preserve-fd 选项用于传递文件描述符列表至容器（替代原有传递固定数量的 --preserve-fds）
  • Quadlet 现支持模板化单元 (#17744)
  • podman kube play 可通过 volume.podman.io/image 注解创建基于镜像的卷
  • 使用 podman kube play 创建的容器现可通过 io.podman.annotations.volumes-from 注解实现容器间卷共享（类似 --volumes-from 选项）(#16819)
  • podman kube play 创建的 Pod 可通过 io.podman.annotations.userns 注解配置用户命名空间 (#20658)
  • Macvlan 和 ipvlan 网络现可通过 containers.conf 的 interface_name 字段调整容器内网络接口名称 (#21313)
  • --gpus 选项现兼容 NVIDIA GPU (#21156)
  • --mount 选项新增 no-dereference 挂载参数以支持将符号链接本身（而非解引用目标）挂载到容器 (#20098)
  • 新增全局选项 --config 用于指定 Docker 配置文件以获取仓库认证信息
  • podman ps --format 新增 .Label 格式符 (#20957)
  • --userns=auto 的 uidmapping 和 gidmapping 现支持通过 @ 前缀映射宿主机 ID
  • Quadlet 新增对 systemd 风格 drop-in 目录的支持
  • Quadlet 新增通过 .pod 单元文件创建 Pod 的支持 (#17687)
  • Quadlet 的 .container 文件新增 Entrypoint 和 StopTimeout 配置项 (#20585 和 #21134)
  • Quadlet 支持在 .container 文件中多次指定 Ulimit 以设置多个资源限制
  • Quadlet 支持设置 Notify=healthy 仅在容器健康检查通过后发送 sdnotify 信号 (#18189)

重大变更

  • podman machine 后端代码重构，配置文件格式变更，Podman 4.x 及更早版本虚拟机不可用，需使用 Podman 5 重建
  • podman machine init 现通过 OCI 工件获取镜像，需有效 policy.json 文件，Windows/macOS 安装程序将自动配置
  • macOS 平台 podman machine 不再支持 QEMU，改用 Apple 原生虚拟化
  • podman machine inspect 移除 ConfigPath 和 Image 字段，不再支持 {{ .ConfigPath }} 和 {{ .Image }} 格式符
  • podman inspect 容器输出格式变更以提升 Docker 兼容性：Entrypoint 改为字符串数组，StopSignal 改为字符串类型
  • 无健康检查的容器 podman inspect 将返回 nil 健康检查字段
  • podman pod inspect 始终返回 JSON 数组（原单 Pod 返回对象）
  • 禁止新建 BoltDB 数据库，新安装默认使用 SQLite，现有 BoltDB 仍可用
  • CNI 网络支持需通过构建标签启用，默认禁用
  • cgroups v1 系统将显示警告，未来版本将移除支持，设置 PODMAN_IGNORE_CGROUPSV1_WARNING 可屏蔽警告
  • Docker API 网络统计信息改为按接口显示（非聚合）
  • rootless 网络默认工具从 slirp4netns 切换为 pasta，不再支持名为 pasta 的网络
  • podman machine init 的 --image 选项替代已弃用的 --image-path
  • podman events --format "{{json .}}" 输出格式变更以兼容 Docker（含 time 和 timeNano 字段）(#14993)
  • podman machine 虚拟机名称和用户名需符合正则 [a-zA-Z0-9][a-zA-Z0-9_.-]*
  • List Images REST API 多过滤器现使用 AND 逻辑（原为 OR）(#18412)
  • 多项 CLI 选项的数组参数解析方式变更，需多次传递参数（不再接受逗号分隔列表），涉及命令包括：
    • podman manifest annotate/add 的 --annotation
    • podman kube play 的 --configmap、--log-opt、--annotation
    • podman image trust set 的 --pubkeysfile
    • podman create/run/push/pull 的 --encryption-key、--decryption-key
    • podman exec 的 --env-file
    • podman create/run 的多个设备参数和环境文件选项
    • 全局选项 --hooks-dir 和 --module

变更

  • podman system reset 不再等待容器优雅停止，直接发送 SIGKILL (#21874)
  • podman network inspect 输出包含使用该网络的运行中容器 (#14126)
  • podman compose 支持非 AMD64/ARM64 架构
  • podman machine 虚拟机现会传递 HTTP 代理环境变量
  • podman kube play/generate 的 --no-trunc 选项已弃用（现遵循 Kubernetes 注解长度规范）
  • 安装 podman-docker 时 rootless 用户默认设置 DOCKER_HOST 环境变量
  • 连接配置迁移至新文件 podman-connections.conf（原 containers.conf 配置仍有效）
  • 多数 podman farm 子命令（除 podman farm build）无需连接 farm 机器即可执行
  • podman create/run 在镜像未定义 entrypoint 时不再强制要求指定
  • macOS podman machine 虚拟机主机挂载内容默认 SELinux 标签改为 system_u:object_r:nfs_t:s0
  • 新建 podman machine 虚拟机使用共享 SSH 密钥（podman machine rm --save-keys 已弃用）

缺陷修复

  • 修复 podman stats 使用 pasta 网络时统计信息缺失问题
  • 修复 HyperV 虚拟机挂载不存在目录的问题
  • 修复 podman compose 不遵守 --connection 和 --url 选项问题
  • 修复 podman stop -t -1 超时逻辑错误 (#21811)
  • 修复使用 slirp4netns 网络和用户命名空间时容器清理死锁问题 (#21477)
  • 修复 macOS 卸载残留 docker.sock 符号链接问题 (#20650)
  • 修复已有卷挂载到容器路径时的权限问题 (#21608)
  • 修复 podman image scp 目标机器 /tmp 空间不足问题 (#21239)
  • 修复 OOM 终止容器状态标记问题 (#13102)
  • 修复 podman kube play 内存型 emptyDir 卷未使用 tmpfs 问题
  • 修复 --rm 容器重启后残留问题 (#21482)
  • 修复远程客户端 podman events 网络事件名称显示问题 (#21311)
  • 修复 podman farm build 的 --tls-verify 处理逻辑 (#21352)
  • 修复 FreeBSD 平台 podman inspect 段错误 (#21117)
  • 修复 Quadlet 处理带反斜杠注释行问题 (#21555)
  • 修复 Quadlet 错误报告机制
  • 修复 Quadlet 处理尾随空格时的挂起问题 (#21109)
  • 修复 Kubernetes YAML 中 bind-mount-options 导致的 Quadlet panic (#21080)
  • 修复 Quadlet 引号处理问题 (#20992)
  • 修复远程客户端 --publish-all 选项失效问题
  • 修复 podman kube play --build 私有仓库自签名证书镜像构建问题 (#20890)
  • 修复容器移除事件退出码错误 (#19124)

API

  • 新增 /libpod/images/$name/resolve 端点用于解析短镜像名
  • 修复 List Images API 多过滤器处理问题
  • 修复 Docker Create API 的 /etc/hosts 条目冲突问题
  • 修复 Libpod/Docker Exec API 交互会话头信息错误
  • API 绑定代码重构减小二进制体积 (#17167)

其他

  • 镜像拉取失败事件现包含错误信息
  • 构建上下文传输改用高性能 gzip 库
  • 更新 Buildah 至 v1.35.1
  • 更新 containers/image 至 v5.30.0
  • 更新 containers/storage 至 v1.53.0
  • 更新 containers/common 至 v0.58.0
  • 更新 libhvee 至 v0.7.0

更新内容 （原始）

5.0.0

Security

  • Fixed CVE-2024-1753 in Buildah and podman build which allowed a user to write files to the / directory of the host machine if selinux was not enabled.

Features

  • VMs created by podman machine can now use the native Apple hypervisor (applehv) when run on MacOS.
  • A new command has been added, podman machine reset, which will remove all existing podman machine VMs and relevant configurations.
  • The podman manifest add command now supports a new --artifact option to add OCI artifacts to a manifest list.
  • The podman create, podman run, and podman push commands now support the --retry and --retry-delay options to configure retries for pushing and pulling images.
  • The podman run and podman exec commands now support a new option, --preserve-fd, which allows passing a list of file descriptors into the container (as an alternative to --preserve-fds, which passes a specific number of file descriptors).
  • Quadlet now supports templated units (#17744).
  • The podman kube play command can now create image-based volumes using the volume.podman.io/image annotation.
  • Containers created with podman kube play can now include volumes from other containers (similar to the --volumes-from option) using a new annotation, io.podman.annotations.volumes-from (#16819).
  • Pods created with podman kube play can now set user namespace options through the the io.podman.annotations.userns annotation in the pod definition (#20658).
  • Macvlan and ipvlan networks can adjust the name of the network interface created inside containers via the new containers.conf field interface_name (#21313).
  • The --gpus option to podman create and podman run is now compatible with Nvidia GPUs (#21156).
  • The --mount option to podman create and podman run supports a new mount option, no-dereference, to mount a symlink (instead of its dereferenced target) into a container (#20098).
  • Podman now supports a new global option, --config, to point to a Docker configuration where we can source registry login credentials.
  • The podman ps --format command now supports a new format specifier, .Label (#20957).
  • The uidmapping and gidmapping options to the podman run --userns=auto option can now map to host IDs by prefixing host IDs with the @ symbol.
  • Quadlet now supports systemd-style drop-in directories.
  • Quadlet now supports creating pods via new .pod unit files (#17687).
  • Quadlet now supports two new keys, Entrypoint and StopTimeout, in .container files (#20585 and #21134).
  • Quadlet now supports specifying the Ulimit key multiple times in .container files to set more than one ulimit on a container.
  • Quadlet now supports setting the Notify key to healthy in .container files, to only sdnotify that a container has started when its health check begins passing (#18189).

Breaking Changes

  • The backend for the podman machine commands has seen extensive rewrites. Configuration files have changed format and VMs from Podman 4.x and earlier are no longer usable. podman machine VMs must be recreated with Podman 5.
  • The podman machine init command now pulls images as OCI artifacts, instead of using HTTP. As a result, a valid policy.json file is required on the host. Windows and Mac installers have been changed to install this file.
  • QEMU is no longer a supported VM provider for podman machine on Mac. Instead, the native Apple hypervisor is supported.
  • The ConfigPath and Image fields are no longer provided by the podman machine inspect command. Users can also no longer use {{ .ConfigPath }} or {{ .Image }} as arguments to podman machine inspect --format.
  • The output of podman inspect for containers has seen a number of breaking changes to improve Docker compatibility, including changing Entrypoint from a string to an array of strings and StopSignal from an int to a string.
  • The podman inspect command for containers now returns nil for healthchecks when inspecting containers without healthchecks.
  • The podman pod inspect command now outputs a JSON array regardless of the number of pods inspected (previously, inspecting a single pod would omit the array).
  • It is no longer possible to create new BoltDB databases; attempting to do so will result in an error. All new Podman installations will now use the SQLite database backend. Existing BoltDB databases remain usable.
  • Support for CNI networking has been gated by a build tag and will not be enabled by default.
  • Podman will now print warnings when used on cgroups v1 systems. Support for cgroups v1 is deprecated and will be removed in a future release. The PODMAN_IGNORE_CGROUPSV1_WARNING environment variable can be set to suppress warnings.
  • Network statistics sent over the Docker API are now per-interface, and not aggregated, improving Docker compatibility.
  • The default tool for rootless networking has been swapped from slirp4netns to pasta for improved performance. As a result, networks named pasta are no longer supported.
  • The --image option replaces the now deprecated --image-path option for podman machine init.
  • The output of podman events --format "{{json .}}" has been changed to improve Docker compatibility, including the time and timeNano fields (#14993).
  • The name of podman machine VMs and the username used within the VM are now validated and must match this regex: [a-zA-Z0-9][a-zA-Z0-9_.-]*.
  • Using multiple filters with the List Images REST API now combines the filters with AND instead of OR, improving Docker compatibility (#18412).
  • The parsing for a number of Podman CLI options which accept arrays has been changed to no longer accept string-delineated lists, and instead to require the option to be passed multiple times. These options are --annotation to podman manifest annotate and podman manifest add, the --configmap, --log-opt, and --annotation options to podman kube play, the --pubkeysfile option to podman image trust set, the --encryption-key and --decryption-key options to podman create, podman run, podman push and podman pull, the --env-file option to podman exec, the --bkio-weight-device, --device-read-bps, --device-write-bps --device-read-iops, --device-write-iops, --device, --label-file, --chrootdirs, --log-opt, and --env-file options to podman create and podman run, and the --hooks-dir and --module global options.

Changes

  • The podman system reset command no longer waits for running containers to gracefully stop, and instead immediately sends SIGKILL (#21874).
  • The podman network inspect command now includes running containers using the network in its output (#14126).
  • The podman compose command is now supported on non-AMD64/ARM64 architectures.
  • VMs created by podman machine will now pass HTTP proxy environment variables into the VM for all providers.
  • The --no-trunc option to the podman kube play and podman kube generate commands has been deprecated. Podman now complies to the Kubernetes specification for annotation size, removing the need for this option.
  • The DOCKER_HOST environment variable will be set by default for rootless users when podman-docker is installed.
  • Connections from podman system connection and farms from podman farm are now written to a new configuration file called podman-connections.conf. As a result, Podman no longer writes to containers.conf. Existing connections from containers.conf will still be respected.
  • Most podman farm subcommands (save for podman farm build) no longer need to connect to the machines in the farm to run.
  • The podman create and podman run commands no longer require specifying an entrypoint on the command line when the container image does not define one. In this case, an empty command will be passed to the OCI runtime, and the resulting behavior is runtime-specific.
  • The default SELinux label for content mounted from the host in podman machine VMs on Mac is now system_u:object_r:nfs_t:s0 so that it can be shared with all containers without issue.
  • Newly-created VMs created by podman machine will now share a single SSH key key for access. As a result, podman machine rm --save-keys is deprecated as the key will persist by default.

Bugfixes

  • Fixed a bug where the podman stats command would not show network statistics when the pasta network mode was used.
  • Fixed a bug where podman machine VMs using the HyperV provider could not mount shares on directories that did not yet exist.
  • Fixed a bug where the podman compose command did not respect the --connection and --url options.
  • Fixed a bug where the podman stop -t -1 command would wait for 0 seconds, not infinite seconds, before sending SIGKILL (#21811).
  • Fixed a bug where Podman could deadlock when cleaning up a container when the slirp4netns network mode was used with a restart policy of always or unless-stopped or on-failure and a user namespace (#21477).
  • Fixed a bug where uninstalling Podman on Mac did not remove the docker.sock symlink (#20650).
  • Fixed a bug where preexisting volumes being mounted into a new container using a path that exists in said container would not be properly chowned (#21608).
  • Fixed a bug where the podman image scp command could fail if there was not sufficient space in the destination machine’s /tmp for the image (#21239).
  • Fixed a bug where containers killed by running out of memory (including due to a memory limit) were not properly marked as OOM killed in podman inspect (#13102).
  • Fixed a bug where podman kube play did not create memory-backed emptyDir volumes using a tmpfs filesystem.
  • Fixed a bug where containers started with --rm were sometimes not removed after a reboot (#21482).
  • Fixed a bug where the podman events command using the remote Podman client did not display the network name associated with network events (#21311).
  • Fixed a bug where the podman farm build did not properly handle the --tls-verify option and would override server defaults even if the option was not set by the user (#21352).
  • Fixed a bug where the podman inspect command could segfault on FreeBSD (#21117).
  • Fixed a bug where Quadlet did not properly handle comment lines ending with a backslash (#21555).
  • Fixed a bug where Quadlet would sometimes not report errors when malformed quadlet files were present.
  • Fixed a bug where Quadlet could hang when given a .container file with certain types of trailing whitespace (#21109).
  • Fixed a bug where Quadlet could panic when generating from Kubernetes YAML containing the bind-mount-options key (#21080).
  • Fixed a bug where Quadlet did not properly strip quoting from values in .container files (#20992).
  • Fixed a bug where the --publish-all option to podman kube play did not function when used with the remote Podman client.
  • Fixed a bug where the podman kube play --build command could not build images whose Dockerfile specified an image from a private registry with a self-signed certificate in a FROM directive (#20890).
  • Fixed a bug where container remove events did not have the correct exit code set (#19124).

API

  • A new API endpoint, /libpod/images/$name/resolve, has been added to resolve a (potential) short name to a list of fully-qualified image references Podman which could be used to pull the image.
  • Fixed a bug where the List API for Images did not properly handle filters and would discard all but the last listed filter.
  • Fixed a bug in the Docker Create API for Containers where entries from /etc/hosts were copied into create containers, resulting in incompatibility with network aliases.
  • Fixed a bug in the Libpod and Docker Exec APIs for Containers which caused incorrect header values to be set when upgrading a connection for an interactive exec session.
  • The API bindings have been refactored to reduce code size, leading to smaller binaries (#17167).

Misc

  • Failed image pulls will now generate an event including the error.
  • The gzip compression library used for sending build contexts, improving performance for remote podman build.
  • Updated Buildah to v1.35.1
  • Updated the containers/image library to v5.30.0
  • Updated the containers/storage library to v1.53.0
  • Updated the containers/common library to v0.58.0
  • Updated the libhvee library to v0.7.0

下载链接