发布日期: 2026-02-10
版本号: v5.8.0-rc1

本次Podman更新包含多项功能增强、变更和错误修复。功能方面，podman quadlet install命令现支持用分隔符安装包含多个Quadlet文件的文档，.container文件新增了AppArmor配置选项，podman artifact add在虚拟机环境下优化了文件加载性能，podman update引入了--ulimit选项，podman exec新增了--no-session选项以提升性能。变更方面，podman secret create -命令现在允许在终端直接输入密钥。错误修复部分解决了多个问题，包括健康检查在初始延迟前执行、事件类型错误、环境变量优先级处理、YAML解析异常、路径处理错误以及远程客户端选项验证等问题。API部分新增了用于管理Quadlet的一系列接口，并修复了日志时间戳精度、健康检查命令处理和接口路径命名等错误。

更新内容 （中文）

功能特性

  • podman quadlet install命令现可安装包含多个独立Quadlet文件的文件。文件需在独立行使用---分隔符，且每个部分必须以# FileName=<名称>开头来命名新的Quadlet（#27384）。
  • Quadlet .container文件新增AppArmor配置项，用于设置容器的AppArmor配置文件（#27095）。
  • 在podman machine虚拟机中使用podman artifact add命令时，若加载或构建路径已共享至虚拟机，Podman将从虚拟机文件系统直接加载数据而非通过REST API流式传输，显著提升性能（#26321）。
  • podman update命令新增--ulimit选项，支持更新容器资源限制配置（#26381）。
  • podman exec命令新增--no-session选项，通过禁用执行会话追踪提升性能和启动速度（#26588）。

变更

  • podman secret create -命令现无需通过管道传入密钥，支持在终端中直接输入密钥内容（#27879）。

错误修复

  • 修复了通过podman play kube创建的容器在健康检查配置initialDelaySeconds时，未等待初始延迟期满即执行检查的问题（#27678）。
  • 修复了因systemd速率限制导致健康检查有时执行失败的问题。
  • 修复了podman export命令错误发出Mount事件而非Export事件的问题。
  • 修复了podman kube play命令错误处理envFrom和env字段环境变量优先级的问题（#27287）。
  • 修复了解析缺少image字段的Pod YAML时podman kube play命令崩溃的问题（#27784）。
  • 修复了podman volume mount命令在插件驱动处理卷时返回空路径的问题（#27858）。
  • 修复了使用--rootfs（非镜像创建）的容器即使未定义健康检查也会显示starting状态的问题（#27651）。
  • 修复了podman build命令的--pull=newer选项功能异常的问题（#22845）。
  • 修复了Quadlet .container文件中RequiresMountsFor字段错误处理含空格绑定挂载路径的问题。
  • 修复了远程Podman客户端podman run --detach-keys选项不接受空字符串（即无分离键）的问题（#27414）。
  • 修复了远程Podman客户端podman build --secret ... env=VAR选项错误尝试在服务端读取环境变量而非客户端的问题（#27494）。
  • 修复了podman artifact push和podman artifact pull命令忽略--authfile选项提供的认证凭据的问题（#27421）。
  • 修复了使用HyperV机器提供程序时Windows路径在某些情况下处理错误的问题（#27571）。
  • 修复了podman run --pod-id-file选项验证缺陷，允许在用户命名空间配置异常的Pod中创建容器的问题（#26848）。

API

  • 新增Quadlet交互接口：GET /libpod/quadlets/{name}/file（输出Quadlet文件内容）、GET /libpod/quadlets/{name}/exists（检查Quadlet是否存在）、POST /libpod/quadlets（安装一个或多个Quadlet）、DELETE /libpod/quadlets（移除一个或多个Quadlet）、DELETE /libpod/quadlets/{name}（移除单个Quadlet）。
  • 修复了容器日志的兼容接口和Libpod接口时间戳未使用纳秒精度的问题（#27961）。
  • 修复了容器兼容创建接口错误处理包含空格参数的健康检查命令的问题（#26519）。
  • 修复了密钥兼容删除接口路径错误命名为DELETE /secret/{name}而非DELETE /secrets/{name}的问题（#27548）。

更新内容 （原始）

Features

  • The podman quadlet install command can now install files which contain multiple separate Quadlet files. The files must be separated with a --- delimeter on a new line, and each section must begin with a # FileName=<name> line to name the new Quadlet (#27384).
  • Quadlet .container files now support a new key, AppArmor, for configuring the container’s AppArmor profile (#27095).
  • When running the podman artifact add command against a podman machine VM, if the path being loaded or built is shared into the VM, Podman will load it from the VM’s filesystem instead of streaming the data through the REST API, improving performance (#26321).
  • The podman update command now features a new option, --ulimit, to update container ulimits (#26381).
  • The podman exec command now features a new option, --no-session, which disables tracking of the exec session to improve performance and startup time (#26588).

Changes

  • The podman secret create - command no longer requires that the secret be provided through a pipe, and instead allows typing the secret through the terminal (#27879).

Bugfixes

  • Fixed a bug where containers created by podman play kube with a healthcheck using the initialDelaySeconds option would run healthchecks before the initial delay had expired (#27678).
  • Fixed a bug where healthchecks would sometimes fail to execute due to systemd rate limits.
  • Fixed a bug where the podman export command would emit a Mount event instead of an Export event.
  • Fixed a bug where the podman kube play command incorrectly handled precedence between environment variables set by both the envFrom and env fields (#27287).
  • Fixed a bug where the podman kube play command would panic when parsing Pod YAML missing the image field (#27784).
  • Fixed a bug where the podman volume mount command returned empty paths when volumes were handled by a plugin driver (#27858).
  • Fixed a bug where containers created with --rootfs instead of from an image would show that they had a healthcheck in the starting state even if no healthcheck was defined (#27651).
  • Fixed a bug where the podman build command’s --pull=newer option did not function correctly (#22845).
  • Fixed a bug where the RequiresMountsFor field in Quadlet .container files incorrectly handled bind-mount paths which contained spaces.
  • Fixed a bug where the remote Podman client’s podman run --detach-keys option did not accept an empty string (IE, no detach keys) (#27414).
  • Fixed a bug where the remove Podman client’s podman build --secret ... env=VAR option would incorrectly try to read the environment variable on the server side, instead of from the client (#27494).
  • Fixed a bug where the podman artifact push and podman artifact pull commands ignored authentication credentials given by the --authfile option (#27421).
  • Fixed a bug where Windows paths were incorrectly handled under some circumstances when using the HyperV machine provider (#27571).
  • Fixed a bug where the podman run --pod-id-file option was not properly validated, allowing the creation of containers in pods with improper user namespace configuration (#26848).

API

  • Added new APIs for interacting with Quadlets, including GET /libpod/quadlets/{name}/file (print contents of a Quadlet file), GET /libpod/quadlets/{name}/exists (check if the given Quadlet exists), POST /libpod/quadlets (install one or more Quadlets), DELETE /libpod/quadlets (remove one or more Quadlets), and DELETE /libpod/quadlets/{name} (remove a single Quadlet).
  • Fixed a bug where the Compat and Libpod Logs endpoints for Containers did not use nanosecond-level precision for reported timestamps (#27961).
  • Fixed a bug where the Compat Create endpoint for Containers incorrectly handled healthcheck commands with arguments containing spaces (#26519).
  • Fixed a bug where the Compat Remove endpoint for Secrets was misnamed as DELETE /secret/{name} instead of DELETE /secrets/{name} (#27548).

下载链接