发布日期: 2025-10-30
版本号: v5.7.0-rc2

Podman新版本引入多项重要功能与改进：远程客户端与API服务器现支持TLS和mTLS加密连接，包括证书客户端认证；podman system connection add命令可创建带TLS加密的TCP套接字连接；podman run与podman create新增--creds和--cert-dir选项以管理镜像拉取的注册中心登录；podman kube play和podman kube down支持输入多个文件以批量管理Pod或部署，同时新增--no-pod-prefix选项；podman machine init增加--tls-verify选项控制镜像拉取的TLS验证；在共享路径的Podman虚拟机中执行podman image load和podman build时，将直接从VM文件系统加载以提升性能；containers.conf现可配置k8s-file日志驱动的日志路径及OCI运行时默认标志；podman artifact命令组增强，支持多参数操作、替换已存在构件、忽略不存在错误、显示创建时间及自定义输出格式；Quadlet新增.artifact文件类型支持、容器/Pod/构建文件的多项配置键（如HttpProxy、StopTimeout、BuildArg）、模板化依赖以及--replace安装选项；podman wait新增--return-on-first选项以在首个容器满足条件时返回。

变更方面：为移除BoltDB做准备，现已默认显示数据库使用警告；引入新的Windows MSI安装器，支持用户级与机器级安装，需先卸载旧版但保留数据；要求Go 1.24；当-p与--network选项共用时增加警告提示；podman stats在FreeBSD上提供更多资源信息；部分命令启用Shell自动补全；构件现默认包含创建时间戳；新增支持Sequoia-PGP签名镜像。

修复内容包括：podman ps的--filter ancestor=现支持子串匹配；podman events的--filter label=现支持仅键匹配；解决Quadlet因Mount缺少source而崩溃及.build文件处理systemd说明符时的生成问题；修复podman info在未挂载binfmt_misc时可能崩溃的问题；解决远程客户端会话输出字节丢失的竞态条件；修复podman build忽略SBOM选项的问题；修正--userns=ns:/path选项与runc 1.1.11及以上版本的兼容性。

API新增列出Quadlets的端点；镜像兼容检查端点移除ContainerConfig字段，改用Config字段；修复多个端点缺少Content-Type响应头的问题。

杂项更新包括改善--device选项的错误信息，并将Buildah、containers/image、containers/storage和containers/common库升级至新版本，后三者现来自统一的containers/container-libs仓库。

更新内容 （中文）

功能特性

  • 远程Podman客户端和podman system service API服务器现支持通过TLS和mTLS加密连接，包括通过证书进行客户端认证（#24583）。
  • podman system connection add命令现可创建与支持TLS和mTLS加密的TCP套接字的连接。
  • podman run和podman create命令新增--creds和--cert-dir两个选项，用于管理从仓库拉取镜像时的登录凭证。
  • podman kube play和podman kube down命令现可接受多个文件作为输入，通过单个命令创建或移除多个Pod或Deployment（#26274）。
  • podman kube play命令新增--no-pod-prefix选项，可禁止在容器名前添加Pod名称前缀。请注意，若Pod与容器同名，此操作可能导致Pod创建失败（#26396）。
  • podman machine init命令新增--tls-verify选项，用于控制是否允许从无受信TLS证书的仓库拉取机器镜像，默认值为true（启用TLS验证）（#26517）。
  • 当对podman machine虚拟机执行podman image load和podman build命令时，若被加载或构建的路径已共享至虚拟机，Podman将从虚拟机文件系统加载数据，而非通过REST API流式传输，从而提升性能（#26321）。
  • 现可通过containers.conf中的log_path选项指定使用k8s-file日志驱动时的容器日志文件默认路径。
  • 现可通过containers.conf中的runtimes_flags选项设置OCI运行时的默认标志。
  • podman artifact remove命令现可接受多个参数，例如：podman artifact rm artifact1 artifact2。
  • podman wait命令新增--return-on-first选项，使podman wait在任意容器匹配条件后即返回，而非等待所有容器匹配条件（#26691）。
  • podman container restore命令新增--tcp-close选项，允许恢复具有活跃TCP连接的容器多次。
  • Quadlet现支持新的.artifact文件类型，允许通过Quadlet管理OCI工件（#25778）。
  • Quadlet .container文件现支持新的HttpProxy键，用于禁止将HTTP代理选项从主机自动转发至容器（#26925）。
  • Quadlet .pod文件现支持新的StopTimeout键，用于配置Pod的停止超时时间（#27120）。
  • Quadlet .build文件现支持BuildArg和IgnoreFile两个新键，用于指定构建参数和忽略文件（#27065和#27268）。
  • Quadlet .kube文件现支持在单个.kube文件中包含多个YAML文件。
  • Quadlet现支持卷和网络的模板化依赖（#25136）。
  • podman quadlet install命令新增--replace选项，将替换任何名称冲突的现有Quadlet（#26930）。
  • podman quadlet print命令新增别名podman quadlet cat（#27296）。
  • 远程Podman客户端的podman artifact remove命令现支持--all选项。
  • podman artifact add命令新增--replace选项，将替换任何具有给定名称的现有工件（#27082）。
  • podman artifact rm命令新增--ignore选项，尝试移除不存在的工件时将忽略错误（#27084）。
  • podman artifact list命令输出现包含工件的创建时间（#27314）。
  • podman artifact list --format选项现支持VirtualSize（返回工件的整数字节大小）和CreatedAt（返回工件创建时间的RFC3339时间戳）两个新格式键（现有Size和Created字段返回人类可读信息）（#27085）。
  • podman artifact inspect命令新增--format选项，用于按用户指定的格式返回工件的特定信息（#27112）。

变更

  • 为计划在Podman 6.0中移除BoltDB数据库做准备，现对仍使用BoltDB的安装添加了警告。这些警告已在Podman 5.6中添加，但默认不可见；现在默认可见。可通过环境变量SUPPRESS_BOLTDB_WARNING=true抑制警告。
  • 引入了新的Windows安装程序，采用更简单的单一MSI架构，支持用户范围（无需管理员权限）和机器范围安装。注意：使用新安装程序前，用户必须卸载现有的Podman安装，但所有容器、镜像、机器和其他数据将保留。旧安装程序仍提供以确保向后兼容性，但将在未来版本中移除（#22994和#25968）。
  • Podman现在要求Go 1.24。
  • 当创建容器时同时使用-p/--publish和--network=ns:/path选项，Podman将不再警告-p选项将被忽略（因为已存在命名空间）（这一直是默认行为，但现在Podman会打印警告）（#26663）。
  • podman stats命令在FreeBSD上运行时，现提供关于容器资源利用的额外信息。
  • 现已为podman create和podman run的--sysctl选项，以及podman network create的--interface-name选项启用Shell自动补全。
  • Podman创建的工件现默认包含创建时间戳，存储于org.opencontainers.image.created注解中（#27081）。
  • podman inspect命令现可检查工件。
  • podman artifact add命令现可覆盖已创建工件中的org.opencontainers.image.title注解。
  • Podman现可选择性地构建并启用Sequoia-PGP支持。构建后，--sign-by-sq-fingerprint选项允许使用Sequoia-PGP密钥对镜像进行签名。

错误修复

  • 修复了podman ps的--filter ancestor=选项需要完全匹配（而Docker支持子字符串匹配）的错误（#26623）。
  • 修复了podman events的--filter label=选项不支持仅键名匹配（如podman os --filter label=所支持）的错误（#26702）。
  • 修复了Quadlet在指定Mount而未指定source时可能发生恐慌的错误。
  • 修复了当.build文件的[Build]部分使用systemd说明符时，Quadlet生成失败的错误（#26746）。
  • 修复了当/proc/sys/fs/binfmt_misc未挂载时，podman info命令可能发生恐慌的错误。
  • 修复了远程Podman客户端由于竞争条件可能丢失附加会话（podman run、podman exec、podman attach）初始输出字节的错误（#26951）。
  • 修复了podman build命令忽略SBOM相关选项的错误（#23915）。
  • 修复了--userns=ns:/path选项在podman create和podman run中与runc 1.1.11及更高版本不兼容的错误（#27148）。

API

  • 新增了列出Quadlet的API端点（GET /libpod/quadlets/json）。
  • 镜像的Compat Inspect端点不再包含ContainerConfig字段。要访问镜像配置，请使用Config字段。这与Docker在v1.45 API中的变更保持一致。
  • 修复了容器（兼容版和libpod）的Stats和Commit端点、镜像（兼容版和libpod）的Push、Commit、Push和Pull端点以及清单（libpod）的Push端点未返回Content-Type头的错误。

其他

  • 改进了向podman create或podman run传递不完整--device选项（例如--device /dev/fuse::）时返回的错误消息。
  • 更新Buildah至v1.42.0。
  • 更新containers/image库至v5.38.0。
  • 更新containers/storage库至v1.61.0。
  • 更新containers/common库至v0.66.0。
  • containers/image、containers/storage和containers/common库现已从containers/container-libs单一代码库获取。

更新内容 （原始）

Features

  • The remote Podman client and podman system service API server now support encrypting connections with TLS and mTLS, including client authentication by certificate (#24583).
  • The podman system connection add command can now create connections to TCP sockets with TLS and mTLS encryption.
  • The podman run and podman create commands now support two new options, --creds and --cert-dir, to manage logging into registries to pull images.
  • The podman kube play and podman kube down commands can now accept multiple files as input, creating or removing more than one pod or deployment with the same command (#26274).
  • The podman kube play command now supports a new option, --no-pod-prefix, to disable prefixing container names with pod names. Please note that this can cause pods to fail to create if the pod shares a name with a container (#26396).
  • The podman machine init command now supports a new option, --tls-verify, to control whether the machine image can be pulled from registries without a trusted TLS certificate, with the default being true (TLS verification on) (#26517).
  • When running the podman image load and podman build commands against a podman machine VM, if the path being loaded or built is shared into the VM, Podman will load it from the VM’s filesystem instead of streaming the data through the REST API, improving performance (#26321).
  • A default location for container log files when using the k8s-file log driver can now be specified with the log_path option in containers.conf.
  • Default flags for the OCI runtime can now be set with the runtimes_flags option in containers.conf.
  • The podman artifact remove command can now accept multiple arguments, for example, podman artifact rm artifact1 artifact2.
  • The podman wait command now supports a new option, --return-on-first, which causes podman wait to return after any container matches the condition, as opposed to waiting for all containers to match (#26691).
  • The podman container restore command now supports a new option, --tcp-close, allowing containers with active TCP connections to be restored multiple times.
  • Quadlet now features support for a new file type, .artifact, allowing OCI artifacts to be managed with Quadlet (#25778).
  • Quadlet .container files now support a new key, HttpProxy, to disable the automatic forwarding of HTTP proxy options from the host into the container (#26925).
  • Quadlet .pod files now support a new key, StopTimeout, to configure the stop timeout for the pod (#27120).
  • Quadlet .build files now support two new keys, BuildArg and IgnoreFile, to specify build arguments and an ignore file (#27065 and #27268).
  • Quadlet .kube files now support multiple YAML files in a single .kube file.
  • Quadlet now supports templated dependencies for volumes and networks (#25136).
  • The podman quadlet install command now supports a new option, --replace, which will replace any existing Quadlet with a conflicting name (#26930).
  • The podman quadlet print command now has a new alias, podman quadlet cat (#27296).
  • The remote Podman client’s podman artifact remove command now supports the --all option.
  • The podman artifact add command now supports a new option, --replace, which will replace any existing artifact with the given name (#27082).
  • The podman artifact rm command now supports a new option, --ignore, which will suppress errors when attempting to remove an artifact that does not exist (#27084).
  • The podman artifact list command now includes artifact creation time in its output (#27314).
  • The podman artifact list --format option now supports two new format keys, VirtualSize, returning the size of the artifact in integer bytes, and CreatedAt, returning the time the artifact was created as an RFC3339 timestamp (the existing Size and Created fields returned human-readable information) (#27085).
  • The podman artifact inspect command now supports a new option, --format, to return specific information about an artifact with user-specified formatting (#27112).

Changes

  • In preparation for a planned removal of the BoltDB database in Podman 6.0, a warning has been added for installations still using BoltDB. These warnings were added in Podman 5.6, but were not visible by default; they now are. They can be suppressed with the SUPPRESS_BOLTDB_WARNING=true environment variable.
  • A new Windows installer has been introduced with a simpler single MSI architecture that supports both user-scope (no admin required) and machine-scope installations. Note: To use the new installer, users must uninstall existing Podman installations before using the new installer, but all containers, images, machines, and other data will be preserved. The old installer is still provided to ensure backwards compatibility, though it will be removed in a future release (#22994 and #25968).
  • Podman now requires Go 1.24.
  • When the -p/--publish and --network=ns:/path options are used together when creating a container, Podman will not warn that the -p option will be ignored as an existing namespace is in use (this has always been the case, but Podman now prints a warning about it) (#26663).
  • The podman stats command now provides additional information about container resource utilization when run on FreeBSD.
  • Shell autocompletion has been enabled for the --sysctl option to podman create and podman run, and the --interface-name option to podman network create.
  • Artifacts created by Podman now include a creation timestamp by default, stored in the org.opencontainers.image.created annotation (#27081).
  • The podman inspect command can now inspect artifacts.
  • The podman artifact add command can now override the org.opencontainers.image.title annotation in created artifacts.
  • Podman can now optionally be built with Sequoia-PGP support. When so built, the --sign-by-sq-fingerprint option allows signing images using Seqoia-PGP keys.

Bugfixes

  • Fixed a bug where the --filter ancestor= option to podman ps required complete matches, unlike Docker (which matched substrings) (#26623).
  • Fixed a bug where the --filter label= option to podman events did not support key-only matches (as podman os --filter label= does) (#26702).
  • Fixed a bug where Quadlet could panic when a Mount was given without a source being specified.
  • Fixed a bug where Quadlet would fail to generate for a .build file when a systemd specifier was used in the [Build] section (#26746).
  • Fixed a bug where the podman info command could panic when /proc/sys/fs/binfmt_misc was not mounted.
  • Fixed a bug where the remote Podman client could lose some initial bytes of output from attach sessions (podman run, podman exec, podman attach) due to a race condition (#26951).
  • Fixed a bug where the podman build command was ignoring SBOM related options (#23915).
  • Fixed a bug where the --userns=ns:/path option to podman create and podman run was broken with runc 1.1.11 and higher (#27148).

API

  • Added a new API endpoint to list quadlets (GET /libpod/quadlets/json).
  • The Compat Inspect endpoint for Images no longer includes the ContainerConfig field. To access image configuration, use the Config field instead. This matches changes made by Docker in the v1.45 API.
  • Fixed a bug where the Stats and Commit endpoints for Containers (compat & libpod), the Push, Commit, Push, and Pull endpoints for Images (compat & libpod), and the Push endpoint for Manifests (libpod) were not returning a Content-Type header.

Misc

  • Error messages returned when an incomplete --device option (for example --device /dev/fuse::) is passed to podman create or podman run have been improved.
  • Updated Buildah to v1.42.0
  • Updated the containers/image library to v5.38.0
  • Updated the containers/storage library to v1.61.0
  • Updated the containers/common library to v0.66.0
  • The containers/image, containers/storage, and containers/common libraries are now sourced from the containers/container-libs monorepo.

下载链接