发布日期: 2026-06-12
版本号: v6.0.0-rc1

Podman 6.0.0 发布，引入了多项破坏性变更和功能增强。破坏性变更包括：必须与特定版本的 Buildah、Skopeo、Netavark 等组件配合使用；移除了对 BoltDB、Intel Mac、Windows 10、cgroups v1、iptables、CNI 网络和 slirp4netns 的支持；配置文件解析逻辑重写；导入路径变更；网络隔离默认启用等。功能方面：新增了 podman machine os update 命令、跨平台虚拟机管理能力、多种容器和网络配置选项（如多 IP 地址、新过滤器）、Quadlet 增强（如支持新挂载类型、搜索路径和命令选项），以及改进了日志、事件和 TLS 配置支持。其他变化包括：podman machine 默认使用 systemd 挂载卷、Mac 默认 provider 改为 libkrun、部分命令行为（如 podman volume prune）与 Docker 对齐、修复了众多 bug 并改进了 API 文档和兼容性。

更新内容 （中文）

重大变更

  • 由于此版本存在重大变更，Podman v6.0.0 必须与 Buildah v1.44.0、Skopeo v1.23、Netavark 和 Aardvark v2.0.0，以及来自 container-libs 仓库 common/v0.68.0 版本的配置文件配合使用。
  • 已放弃对 BoltDB 数据库的支持。从 Podman 6 开始，如果使用 BoltDB 数据库，Podman 将尝试从 SQLite 自动迁移到 BoltDB。
  • 已移除对在 Intel Mac 上运行的支持。
  • 已移除对在 Windows 10 上运行的支持。
  • 已移除对在 cgroups v1 系统上运行的支持。请更新您的系统以使用 cgroups v2。
  • 已移除对在 iptables 上运行的支持。请改用 nftables。
  • 已移除对 CNI 网络的支持。请改用 Netavark。
  • 已移除对 slirp4netns 无 root 网络栈的支持。请改用 Pasta。作为此变更的一部分，仅与 slirp4netns 一起使用的 --network-cmd-path 全局选项已被移除。
  • Podman 的配置文件解析逻辑经过重大重写。有关确切细节，请参见此文档。
  • 作为我们迁移到 CNCF 拥有的 GitHub 组织的一部分，Podman 的导入路径已从 github.com/containers/podman/v5 更改为 go.podman.io/podman/v6。
  • 网络隔离现在默认启用，提高了 Docker 兼容性和安全性。为隔离被禁用的 Docker 兼容 API 特定处理方式已被移除 (#27349)。
  • podman quadlet 命令套件的功能方式已更改。以前，Quadlet 及其关联文件使用 .app 文件跟踪，确保移除 Quadlet 也会移除所有关联的非 Quadlet 文件。现在，Quadlet 及其关联文件放置在子目录中，这应能减少错误，并使手动管理通过 podman quadlet install 添加的 Quadlet 变得更加容易。
  • podman machine 在 Linux 上创建的虚拟机现在使用 systemd 挂载来自主机的卷。此更改导致 Linux 上现有 podman machine 虚拟机的卷挂载中断，需要重新创建虚拟机。
  • podman volume prune 命令现在与 Docker 行为一致，仅清理未使用的匿名卷。请使用新增的 --all 选项来恢复之前的行为（清理所有卷）。
  • podman volume list 命令现在使用逻辑 AND 而非逻辑 OR 组合多个过滤器（这意味着所有过滤器都必须匹配才能将容器包含在输出中）(#26786)。
  • 许多命令中使用的 label!= 过滤器现在使用逻辑 AND 而非逻辑 OR 组合多个过滤器实例的输出。
  • podman ps、podman pod ps 和 podman volume ls 命令的 --format='{{json .Labels}} 选项现在以逗号分隔的 key=value 对形式打印输出，而不是 JSON 映射，提高了 Docker 兼容性 (#21847)。
  • podman machine list 的 --all-providers 选项已被移除，因为现在所有命令都可以访问所有提供程序的虚拟机。
  • 当用户未明确设置时，podman inspect 的 MemorySwappiness 字段现在设置为 nil（而不是 -1），提高了 Docker 兼容性 (#23824)。
  • podman commit 命令现在在提交更改时暂停容器，通过限制并发修改来提高安全性。可以通过使用 podman commit --pause=false ... 来恢复之前的行为。
  • REST API 的 Go 绑定已从 artifacts.Remove() 函数中移除了冗余的 nameOrID 参数。
  • 构建 Podman 所需的最低 Go 版本现在为 v1.25。

功能

  • 所有 podman machine 命令现在可以操作来自所有提供程序的虚拟机，无论当前提供程序设置为何。配置中设置的提供程序仅决定新创建的虚拟机使用的提供程序，并且可以通过新的 podman machine init --provider 选项覆盖。这应使在 Mac 和 Windows 安装中混合使用 applehv 和 libkrun 虚拟机，或 hyperv 和 wsl 虚拟机变得更加容易。
  • 新增了一个命令 podman machine os update，用于更新 podman machine 虚拟机的操作系统。请注意，wsl 提供程序不支持此功能。
  • 新增了一个命令 podman system hyperv-prep，允许 Windows 管理员为主机做准备，使其用户能够使用 hyperv 提供程序运行 podman machine 虚拟机。
  • 使用 podman machine start 和 podman machine init --now 启动虚拟机时，如果该虚拟机的连接不是默认连接，用户将被提示是否要将默认连接更改为刚刚启动的机器。这也可以通过新选项 --update-connection 来控制，该选项控制是否更新默认连接。如果设置了 --update-connection 选项，则不会显示用户交互式提示。
  • podman machine init 和 podman machine set 命令现在支持一个新选项 --import-native-ca，设置后，Windows、Linux 和 Mac 上的 podman machine 虚拟机将在每次启动时导入主机的受信任 CA 证书。
  • podman exec 命令现在有一个新选项 --no-session，禁用 API 会话跟踪和数据库操作以提高性能 (#26727)。
  • podman image list --format json 命令现在为每个镜像包含两个新字段 Repository 和 Tag (#27632)。
  • Quadlet 的手册页已拆分为多个文件，每种 Quadlet 文件类型一个，并且应该更加易读。
  • Quadlet .volume 单元现在支持三个新键：UID= 和 GID=（用于设置创建卷时使用的 UID 和 GID）以及 Options=（用于设置通用卷选项）。
  • Quadlet .container 单元现在支持挂载匿名卷（使用未指定源的 Mount= 键）(#28497)。
  • 新增了两个 Quadlet 的搜索路径：/usr/share/containers/systemd/users 和 /usr/share/containers/systemd/users/${UID}，以允许发行版更轻松地打包和分发 Quadlet (#27843)。
  • podman quadlet list 命令现在有一个新别名 podman quadlet ls。
  • podman quadlet list 命令现在有一个新选项 --noheading，用于禁用打印表头。如果使用了 --format 选项，则会自动设置此选项。
  • podman quadlet list 命令现在在其输出中包含一个新字段 Pod，打印 Quadlet .container 单元所属的 pod。
  • podman quadlet list 命令的 --filter 选项现在支持一个新的过滤器 status= (#28369)。
  • podman create 和 podman run 的 --gpus 选项现在兼容 AMD GPU。
  • podman create、podman run 和 podman pod create 命令现在可以使用新选项 nocreate 来指定卷（例如 podman run --mount type=volume,src=myvol,dst=/mnt,nocreate），如果指定的卷不存在，将返回错误，而不是创建它。
  • podman run 和 podman create 的 --log-opt 选项现在支持一个新选项 label=，用于将额外标签附加到记录的消息（仅当使用 journald 日志驱动程序时可用）。
  • 许多 Podman 命令现在公开了 --tls-details 选项，允许使用 containers-tls-details.yaml(5) 文件自定义调整 TLS 设置。
  • 容器的 died 事件现在公开了一个新属性 OOMKilled，如果设置，则表示容器因内存不足而停止 (#26701)。
  • 容器现在可以通过多次传递 ip= 选项给 --net 来设置多个静态 IP 地址（例如 --net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4）。
  • podman volume prune 命令现在包含一个新选项 --all，用于清理所有未使用的卷，而不仅仅是匿名卷 (#24597)。
  • podman volume prune 命令现在包含一个新选项 --dry-run，它将返回将要被移除的卷，但不会实际移除它们 (#27838)。
  • podman image scp 命令现在包含一个新选项 --format，用于设置镜像传输使用的归档格式 (#28183)。
  • containers.conf 中新增了一个字段 default_host_ips，用于设置如果用户未指定 IP，端口转发使用的默认主机 IP (#27186)。
  • podman image trust 命令套件现在支持一个新选项 --signature-policy，该选项对于 podman image trust set 是必需的。
  • 事件现在包含制品生命周期事件（create、pull、push 和 remove）(#27260)。
  • 在 containers.conf 的 rootless_port_forwarder 字段中新增了一个实验性选项 rootless_port_forwarder="pasta"。设置后，无 root 桥接网络将使用 Pasta 通过 Pesto 的内核级端口转发，而不是 rootlessport，从而在无 root 容器的网络流量中保留原始客户端源 IP。默认值仍为 rootlessport（Podman 5.x 的默认值），但我们将在稳定性更确定时调查切换。
  • podman ps 和 podman container prune 命令中新增了一个过滤器 --filter annotation=，用于根据注解过滤容器 (#28562)。
  • podman network create 命令的 --route 选项现在可以创建黑洞路由、不可达路由和禁止路由，以防止容器访问某些网络（例如 podman network create --route 10.20.30.40/24,blackhole ...）(#20022)。
  • 在 podman 网络中新增了对黑洞路由、不可达路由和禁止路由类型的支持。自 netavark 2.0 起支持。
  • podman info 命令现在报告 CDI 规范目录和已发现的 CDI 设备。
  • 由 pod 和卷生成的事件现在将 pod/卷的标签作为属性包含，与容器事件的行为匹配 (#26480)。

变更

  • podman machine 创建的虚拟机现在将主机的用户配置（例如 Linux 上的 ~/.config/containers）挂载到机器中的 /etc/containers，允许用户直接编辑控制 Podman 行为的配置文件。
  • Mac 上默认的 podman machine 提供程序已更改为 libkrun。
  • 在 Windows 上使用 hyperv 提供程序启动和停止 podman machine 虚拟机不再需要管理员权限（创建机器仍需要管理员权限）。需要提升权限的操作将提示管理员访问。请注意，这仅适用于新创建的虚拟机。
  • podman pod inspect 命令现在以确定的顺序打印其输出中的数组。
  • podman machine os apply 命令已更新，现在使用 bootc switch 应用更改。可以使用 bootc switch 支持的所有传输方式来应用新镜像。
  • 新增了一个实验性功能，在使用内核 6.18 及更新版本的系统上，无 root Podman 将不再需要创建暂停进程来保持无 root 用户命名空间打开，而是使用 nsfs 文件句柄。此行为当前需要通过设置环境变量 drop-pause-process 来启用。
  • 使用 --net=host 创建的容器现在将使用 127.0.0.1 作为其 host.containers.internal 地址，而不是机器的公网 IP (#27823)。
  • 多个网络中的容器现在根据它们在命令行上传递的顺序以确定性顺序配置这些网络。
  • 使用进程替换构建镜像时，例如 podman build -f <(<<<"FROM scratch")，现在使用一个空的临时目录作为上下文目录 (#28113)。
  • 在 Podman 5.x 及以下版本中，镜像 ID（对于 OCI 和 Docker v2s2 镜像）始终等于镜像配置数据的 SHA256 摘要。未来版本的 Podman 将添加对非 SHA256 摘要的支持，并且对于不使用 SHA256 摘要的镜像，镜像 ID 格式将发生变化。新 ID 的确切格式尚未确定，但在未来的 Podman 版本中，假设镜像 ID 是有效哈希值将不再成立。

缺陷修复

  • 修复了一个错误，即从属于 pod 的模板化 .container 文件创建 Quadlet 时，会错误地将对用于容器的模板的依赖添加到 pod (#27844)。
  • 修复了一个错误，即 Quadlet .pod 文件即使在用户指定了替代重启策略时也会无条件设置 Restart=on-failure (#28081)。
  • 修复了一个错误，即在 Windows 上使用 hyperv 提供程序启动 podman machine 虚拟机时，如果虚拟机在首次启动时失败则会启动失败 (#27930)。
  • 修复了一个错误，即 podman machine init 和 podman machine set 允许创建具有比主机上可用 CPU 更多的 CPU 的虚拟机，从而创建无法启动的虚拟机 (#28322)。
  • 修复了一个错误，即制品卷仅在容器启动时检查制品的有效性，允许创建引用不存在的制品的容器，从而永远无法启动 (#27747)。
  • 修复了一个错误，即具有环境秘钥的容器在某些情况下重启后可能会丢失秘钥值 (#28075)。
  • 修复了一个错误，即在没有 --import 选项或检查点镜像的情况下使用 podman container restore --publish 命令时，会静默忽略 --publish 选项，而不是报错。
  • 修复了一个错误，即在 Windows 上使用 wsl 提供程序运行嵌套的无 root Podman 容器是不可能的 (#27411)。
  • 修复了一个错误，即 podman container clone 命令在克隆使用环境秘钥（--secret type=env,...）创建的容器时会失败 (#28130)。
  • 修复了一个错误，即当选择除 journald 以外的日志驱动程序时，允许使用 tag= 日志选项（--log-opt tag=mytag）创建容器。
  • 修复了一个错误，即某些命令的 --help 输出格式不正确 (#28178)。
  • 修复了一个错误，即 pod 中具有多个卷挂载的容器可能会出现一个卷的挂载选项泄漏到其他挂载的情况。
  • 修复了一个错误，即远程 Podman 客户端的 podman version 命令在无法连接到服务器时（例如 podman machine 虚拟机已关闭）会报错。在这种情况下，现在打印客户端版本 (#28222)。
  • 修复了一个错误，即如果暂停进程被终止且其 PID 被回收给另一个进程，无 root Podman 将显示错误并拒绝启动 (#28157)。
  • 修复了一个错误，即在名称中包含 . 字符的卷的容器上运行 podman kube generate 会生成无效的 YAML (#27620)。
  • 修复了一个错误，即 .containerignore 和 .dockerignore 文件中以斜杠开头或结尾的模式在远程构建期间被静默忽略 (#25458)。
  • 修复了一个错误，即在使用 --transient-store 选项创建的容器上的健康检查会失败 (#28483)。
  • 修复了一个错误，即在没有基础设施容器的 pod 上运行 podman generate spec 命令时会发生 panic (#21609)。
  • 修复了一个错误，即 podman container inspect 命令可能会在输出中 HTML 转义某些字符 (#28560)。
  • 修复了一个错误，即向包含多个容器的 pod 的 /etc/hosts 添加条目时，当任何容器停止时，会错误地为 pod 中的所有容器移除 /etc/hosts 中的条目。
  • 修复了一个错误，即没有 /dev/mqueue 的主机可能无法启动容器，因为 Podman 会无条件尝试添加该设备。
  • 修复了一个错误，即检查未设置网关的网络时，会将网关显示为 <nil> 而不是不显示任何内容 (#28705)。
  • 修复了一个错误，即允许创建具有包含重复主机端口的端口映射的容器或 pod，而由于端口冲突，此配置永远无法启动。
  • 修复了一个错误，即远程 Podman 客户端无法连接到用户 SSH 配置中具有自定义 HostName 的任何主机 (#25067)。
  • 修复了一个错误，即 podman inspect --type=all 命令在尝试检查多个网络时，会多次仅输出其中一个网络。
  • 修复了一个错误，即使用 http_proxy=true 设置的 Quadlet .container 文件在创建 systemd 单元文件时，未能正确转义添加到容器的环境变量中的特殊字符 (#28698)。
  • 修复了一个错误，即使用远程 Podman 客户端创建的容器忽略了 containers.conf 中的 log_path 设置 (#28792)。
  • 修复了一个错误，即远程 Podman 客户端的 podman save 命令在 Linux 上使用 -f oci-dir 或 -f docker-dir 参数时会失败。 修复了一个问题，导致 podman-remote save -f oci-dir/docker-dir 在 Linux 上失败。

API

  • 已对 API 文档进行改进，记录了之前缺失文档的字段。期待未来版本中更多的 API 文档改进！
  • 支持的 Docker 兼容 API 版本已升级到 v1.44。
  • 所有接受 JSON body 参数的 API 请求在提供空 body 时不再报错。
  • 容器的兼容列表端点现在在其输出中包含一个新字段 Health，提供容器健康检查状态的信息 (#27786)。
  • 新增了一个 API POST /libpod/local/artifacts/add，用于从本地系统加载制品（不需要传输 tarball）。
  • 用于从本地系统加载镜像的 POST /libpod/local/images 端点现在要求 path 查询参数是绝对路径，而不是相对路径。
  • 镜像的 Libpod 拉取端点现在可以在设置 pullProgress 查询参数为 true 时报告拉取进度。
  • 镜像的 Libpod 拉取端点现在在拉取镜像失败时返回错误状态码，而不是始终返回 HTTP 200。
  • 修复了一个错误，即创建容器时卷的 subpath 选项被忽略 (#27171)。
  • 修复了一个错误，即容器的 Libpod 创建端点忽略了 OCIRuntime 字段。
  • 修复了一个错误，即容器的兼容创建端点在尝试创建名称已使用的容器时返回 500（而不是 409）。
  • 修复了一个错误，即容器的兼容创建端点错误处理 HostConfig.Devices 中的 CDI 限定条目，大大提高了使用兼容 API 时 CDI 设备的可靠性。
  • 修复了一个错误，即兼容信息端点在使用非默认配置文件时不返回 Seccomp 配置文件的位置 (#28379)。
  • 修复了一个错误，即容器的兼容列表端点可能返回无效的容器状态字符串 (#28359)。
  • 修复了一个错误，即容器的兼容列表端点在其响应中未包含 HostConfig 字段。
  • 修复了一个错误，即容器的兼容等待端点在等待 next-exit 条件时会无限期挂起 (#28514)。
  • 修复了一个错误，即容器的兼容和 Libpod 更新端点如果 API 请求中未明确设置，会清除容器的 rlimits。
  • 修复了一个错误，即镜像的兼容推送端点未返回包含推送镜像的标签、摘要和大小的最终 JSON 对象，而 Docker 会这样做。

杂项

  • 已启用对使用 podman inspect 检查制品的自动补全。
  • 已更新 Buildah 到 v1.44.0
  • 已更新镜像库到 v5.40.0
  • 已更新存储库到 v1.63.0
  • 已更新公共库到 v0.68.0

更新内容 （原始）

Breaking Changes

  • Due to breaking changes in this release, Podman v6.0.0 must be used with Buildah v1.44.0, Skopeo v1.23, Netavark and Aardvark v2.0.0, and configuration files from the container-libs repository’s common/v0.68.0 release.
  • Support for BoltDB databases has been dropped. Starting Podman 6 when the BoltDB database is in use will have Podman attempt an automatic migration from SQLite to BoltDB.
  • Support for running on Intel Macs has been removed.
  • Support for running on Windows 10 has been removed.
  • Support for running on cgroups v1 systems has been removed. Please update your system to use cgroups v2.
  • Support for running on iptables has been removed. Please use nftables instead.
  • Support for CNI networking has been removed. Please use Netavark instead.
  • Support for the slirp4netns rootless network stack has been removed. Please use Pasta instead. As part of this, the --network-cmd-path global option, only used with slirp4netns, has been removed.
  • Podman’s configuration file parsing logic has seen a major rewrite. Please see this document for exact details.
  • Podman’s import path has changed from github.com/containers/podman/v5 to go.podman.io/podman/v6 as part of our move into a CNCF-owned GitHub organization.
  • Network isolation now defaults to enabled, improving Docker compatibility and security. A special workaround for the Docker-compatible API related to isolation being disabled has been removed (#27349).
  • The way the podman quadlet suite of commands functions has been changed. Previously, Quadlets and their associated files were tracked using a .app file, ensuring that removing a Quadlet also removed all associated non-Quadlet files. Now, Quadlets and associated files are placed in subdirectories, which should reduce bugs and make manual management of Quadlets added by podman quadlet install much easier.
  • VMs made by podman machine on Linux now mount volumes from the host using systemd. Volume mounts on existing podman machine VMs on Linux have been broken by this change, and the VM will need to be recreated.
  • The podman volume prune command now matches Docker’s behavior by only pruning unused anonymous volumes. Please use the newly-added --all option for the previous behavior (pruning all volumes).
  • The podman volume list command now combines multiple filters using logical AND instead of logical OR (meaning all filters must match for a container to be included in output) (#26786).
  • The label!= filter used in many commands now combines the output of multiple instances of the filter with logical AND instead of logical OR.
  • The --format='{{json .Labels}} option to the podman ps, podman pod ps, and podman volume ls commands now prints its output as comma-separated key=value pairs instead of as a JSON map, improving Docker compatibility (#21847).
  • The --all-providers option to podman machine list has been removed, as machines from all providers can now be accessed by all commands.
  • The MemorySwappiness field of podman inspect is now set to nil when not explicitly set by the user (instead of -1), improving Docker compatibility (#23824).
  • The podman commit command now pauses the container while committing changes, improving security by restricting concurrent modification. The prior behavior can be restored by using podman commit --pause=false ....
  • The Go bindings for the REST API have removed the redundant nameOrID parameter from the artifacts.Remove() function.
  • The minimum Go version required to build Podman is now v1.25.

Features

  • All podman machine commands can now operate on VMs from all providers, regardless of what the current provider is set to. The provider set in the configuration only determines the provider used by newly-created VMs, and can be overridden by the new podman machine init --provider option. This should make operation of Mac and Windows installs mixing use of applehv and libkrun VMs, or hyperv and wsl VMs, much easier.
  • A new command has been added, podman machine os update, which updates the operating system of a podman machine VM. Please note that this is not supported with the wsl provider.
  • A new command has been added, podman system hyperv-prep, allowing Windows administrators to prepare a host for their users to run podman machine VMs using the hyperv provider.
  • When starting a VM with podman machine start and podman machine init --now, if the connection to that VM is not the default, users will be prompted whether they want to change the default to the machine that was just started. This can also be controlled by a new option, --update-connection, which controls whether the default will be updated. If the --update-connection option is set, a user-interactive prompt is not displayed.
  • The podman machine init and podman machine set commands now support a new option, --import-native-ca, which, when set, causes podman machine VMs on Windows, Linux, and Mac to import the host’s trusted CA certificates each time the VM boots.
  • The podman exec command now has a new option, --no-session, disabling API session tracking and database operations to increase performance (#26727).
  • The podman image list --format json command now includes two new fields for each image, Repository and Tag (#27632).
  • The manpages for Quadlets have been split into multiple files, one for each type of Quadlet file, and should be much more readable.
  • Quadlet .volume units now support three new keys, UID= and GID= (to set the UID and GID that the volume will be created with) and Options= (to set generic volume options).
  • Quadlet .container units now support mounting anonymous volumes (using a Mount= key with no source specified) (#28497).
  • Two new search paths for Quadlets have been added, /usr/share/containers/systemd/users and /usr/share/containers/systemd/users/${UID}, to allow distributions to more easily package and distribute Quadlets (#27843).
  • The podman quadlet list command now has a new alias, podman quadlet ls.
  • The podman quadlet list command now has a new option, --noheading, which disables printing the table header. This is set automatically if the --format option is used.
  • The pomdan quadlet list command now includes a new field in its output, Pod, which prints the pod a Quadlet .container unit is part of.
  • The podman quadlet list command’s --filter option now supports a new filter, status= (#28369).
  • The --gpus option to podman create and podman run is now compatible with AMD GPUs.
  • The podman create, podman run, and podman pod create commands can now specify volumes with a new option, nocreate (e.g. podman run --mount type=volume,src=myvol,dst=/mnt,nocreate) which will error if the specified volume does not exist, instead of creating it.
  • The --log-opt option to the podman run and podman create now supports a new option, label=, to attach additional labels to logged messages (only usable with the journald log driver).
  • Many Podman commands now expose a --tls-details option, allowing custom tuning of TLS settings using a containers-tls-details.yaml(5) file.
  • The died event for Containers now exposes a new attribute, OOMKilled, which (if set) indicates the container was stopped due to running out of memory (#26701).
  • Containers can now set multiple static IP addresses by passing the ip= option to --net multiple times (e.g. --net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4).
  • The podman volume prune command now includes a new option, --all, to prune all unused volumes, not just anonymous volumes (#24597).
  • The podman volume prune command now includes a new option, --dry-run, which returns the volumes that would be removed but does not actually remove them (#27838).
  • The podman image scp command now includes a new option, --format, to set the archive format used for the image transfer (#28183).
  • A new field has been added to containers.conf, default_host_ips, to set the default host IP that ports are forwarded from if an IP is not specified by the user (#27186).
  • The podman image trust suite of commands now support a new --signature-policy option, which is mandatory for podman image trust set.
  • Events now include artifact lifecycle events (create, pull, push, and remove) (#27260).
  • A new experimental option for the rootless_port_forwarder field in containers.conf has been added, rootless_port_forwarder="pasta". When set, rootless bridge networks will use Pasta’s kernel-level port forwarding via Pesto instead of rootlessport, preserving the original client source IP in network traffic in rootless containers. The default remains rootlessport (the default for Podman 5.x), but we will investigate switching at a later date when stability is more certain.
  • A new filter has been added to the podman ps and podman container prune commands, --filter annotation=, to filter containers based on their annotations (#28562).
  • The podman network create command’s --route option can now create blackhole, unreachable, and prohibit routes to prevent containers from reaching certain networks (e.g. podman network create --route 10.20.30.40/24,blackhole ...) (#20022).
  • Add support for blackhole, unreachable, and prohibit route types in podman networks. Supported since netavark 2.0.
  • The podman info command now reports CDI spec directories and discovered CDI devices.
  • Events generated by pods and volumes now include the pod/volume’s labels as attributes, matching the behavior of container events (#26480).

Changes

  • VMs created by podman machine now mount the host’s user configurations (e.g. ~/.config/containers on Linux) into the machine at /etc/containers, allowing users to edit the config files controlling Podman’s behavior directly.
  • The default podman machine provider on Macs has been changed to libkrun.
  • Starting and stopping podman machine VMs on Windows with the hyperv provider no longer requires administrator privileges (creating machines still requires admin, however). Operations requiring elevated privileges will prompt for administrator access. Please note that this only works with newly-created VMs.
  • The podman pod inspect command now prints arrays in its output in deterministic order.
  • The podman machine os apply command has been updated, and now uses bootc switch to apply changes. All transports supported by bootc switch can be used for the new image to apply.
  • An experimental feature has been added where, on systems using Kernel 6.18 and newer, rootless Podman will no longer need to create a pause process to hold open the rootless user namespace, instead using an nsfs file handle. This behavior is currently gated behind an environment variable, drop-pause-process, being set.
  • Containers created with --net=host will now use 127.0.0.1 for their host.containers.internal address, instead of a public IP of the machine (#27823).
  • Containers in multiple networks now have these networks configured in a deterministic order based on the order they were passed on the command line.
  • When building an image with process substitution, such as podman build -f <(<<<"FROM scratch") , an empty temporary directory is now used as the context directory (#28113).
  • In Podman versions 5.x and under, image IDs (for both OCI and Docker v2s2 images) were always equal to the SHA256 digest of the image’s config data. A future version of Podman will add support for non-SHA256 digests, and image ID format will change for images that are not using the SHA256 digest. The exact format of the new IDs has not yet been decided, but the assumption that image IDs are valid hashes will no longer be true in future Podman versions.

Bugfixes

  • Fixed a bug where creating a Quadlet from a templated .container file that was part of a pod would incorrectly add a dependency on the template used for the container to the pod (#27844).
  • Fixed a bug where Quadlet .pod files would unconditionally set Restart=on-failure even when the user specified an alternative restart policy (#28081).
  • Fixed a bug where starting a podman machine VM on Windows using the hyperv provider would fail if the machine failed to start on first boot (#27930).
  • Fixed a bug where podman machine init and podman machine set allowed creating VMs with more CPUs than were available on the host, creating VMs that could not be started (#28322).
  • Fixed a bug where artifact volumes only checked the validity of the artifact when the container was started, allowing containers to be created that referenced artifacts which did not exist and thus could never be started (#27747).
  • Fixed a bug where containers with environment secrets could lose the value of the secret after a restart under some circumstances (#28075).
  • Fixed a bug where the podman container restore --publish command would silently ignore the --publish option instead of erroring when used without the --import option or a checkpoint image.
  • Fixed a bug where running nested rootless Podman containers on Windows using the wsl provider was not possible (#27411).
  • Fixed a bug where the podman container clone command would fail with containers created with environment secrets (--secret type=env,...) (#28130).
  • Fixed a bug where creating a container with the tag= log option (--log-opt tag=mytag) was allowed when a log driver other than journald was selected.
  • Fixed a bug where the output of --help with some commands was incorrectly formatted (#28178).
  • Fixed a bug where containers in pods with multiple volume mounts could have mount options from one volume mount leak to other mounts.
  • Fixed a bug where the remote Podman client’s podman version command would error if the server could not be connected to (e.g. the podman machine VM was shut down). In this case, client version is now printed (#28222).
  • Fixed a bug where rootless Podman would display errors and refuse to launch if the pause process was killed and its PID recycled to another process (#28157).
  • Fixed a bug where running podman kube generate on a container including volumes with . characters in their names produced invalid YAML (#27620).
  • Fixed a bug where patterns in .containerignore and .dockerignore files that began or ended with slashes were silently ignored during remote builds (#25458).
  • Fixed a bug where healthchecks on containers created using the --transient-store option would fail (#28483).
  • Fixed a bug where the podman generate spec command would panic when run on a pod with no infra container (#21609).
  • Fixed a bug where the podman container inspect command could HTML-escape certain characters in its output (#28560).
  • Fixed a bug where pods with entries added to /etc/hosts containing multiple containers would incorrectly remove entries from /etc/hosts for all containers in the pod when any container stopped.
  • Fixed a bug where hosts without /dev/mqueue could be unable to start containers as Podman attempted to add the device unconditionally.
  • Fixed a bug where inspecting networks without a gateway set would show the gateway as <nil> instead of the showing nothing (#28705).
  • Fixed a bug where creating a container or pod with port mappings including duplicated host ports was allowed, when this configuration could never be started due to the port conflict.
  • Fixed a bug where the remote Podman client was unable to connect to any host with a custom HostName in the user’s SSH config (#25067).
  • Fixed a bug where the podman inspect --type=all command would, when attempting to inspect multiple networks, output only one of the networks multiple times.
  • Fixed a bug where Quadlet .container files using the http_proxy=true setting did not properly escape special characters in the environment variables added to the container when creating the systemd unit file (#28698).
  • Fixed a bug where containers created using the remote Podman client ignored the log_path setting in containers.conf (#28792).
  • Fixed a bug where the remote Podman client’s podman save command would fail on Linux when using the -f oci-dir or -f docker-dir arguments.

Fixed an issue that made podman-remote save -f oci-dir/docker-dir fail on linux.

API

  • An improvement pass has been made over API documentation to document fields which were missing documentation. Look forward to more API documentation improvements in future releases!
  • The supported Docker Compatible API version has been bumped to v1.44.
  • All API requests that accept JSON body parameters will no longer error if an empty body is provided.
  • The Compat List endpoint for Containers now includes a new field in its output, Health, providing information on the status of the container’s healthcheck (#27786).
  • Added a new API, POST /libpod/local/artifacts/add, for loading artifacts from the local system (not requiring transmission of a tarball).
  • The POST /libpod/local/images endpoint for loading images from the local system now requires that the path query parameter is an absolute path, not a relative path.
  • The Libpod Pull endpoint for Images can now report pull progress when the pullProgress query parameter is set to true.
  • The Libpod Pull endpoint for Images now returns error status codes on failure to pull imges, instead of always returning HTTP 200.
  • Fixed a bug where the subpath option for volumes when creating containers was ignored (#27171).
  • Fixed a bug where the Libpod Create endpoint for Containers ignored the OCIRuntime field.
  • Fixed a bug where the Compat Create endpoint for Containers returned a 500 (not a 409) when attempting to create a container with a name that was already in use.
  • Fixed a bug where the Compat Create endpoint for Containers incorrectly handled CDI-qualified entries in HostConfig.Devices, greatly improving the reliability of CDI devices when using the Compat API.
  • Fixed a bug where the Compat Info endpoint did not return the location of the Seccomp profile if a non-default profile was in use (#28379).
  • Fixed a bug where the Compat List endpoint for Containers could return an invalid string for container status (#28359).
  • Fixed a bug where the Compat List endpoint for Containers did not include the HostConfig field in its responses.
  • Fixed a bug where the Compat Wait endpoint for Containers would hang indefinitely when waiting for the next-exit condition (#28514).
  • Fixed a bug where the Compat and Libpod Update endpoints for Containers would clear the rlimits of the container if they were not explicitly set in the API request.
  • Fixed a bug where the Compat Push endpoint for Images did not return a final JSON object including tag, digest, and size of the pushed image, as Docker does.

Misc

  • Autocomplete has been enabled for inspecting artifacts with podman inspect.
  • Updated Buildah to v1.44.0
  • Updated the image library to v5.40.0
  • Updated the storage library to v1.63.0
  • Updated the common library to v0.68.0

下载链接