发布日期: 2026-06-24
版本号: v6.0.0

Podman v6.0.0已发布，主要包含以下更新：修复了两个安全漏洞（CVE-2026-57231和CVE-2026-19730），解决了环境变量泄漏和Quadlet文件替换不彻底的问题。引入多项破坏性变更：需要与特定版本的Buildah、Skopeo、Netavark等组件配合使用，停止支持BoltDB数据库（自动迁移到SQLite）、Intel Mac、Windows 10、cgroups v1、iptables、CNI网络和slirp4netns，配置文件解析逻辑大幅重构，容器镜像的导入路径已更改。网络隔离现在默认启用，podman quadlet命令工作方式改变，podman volume prune默认仅修剪未使用的匿名卷，podman volume list过滤器的逻辑组合改为AND，多个命令的输出格式与Docker兼容性提升。新功能包括：所有podman machine命令可跨虚拟机提供者操作，新增podman machine os update命令，podman exec支持--no-session选项，镜像列表增加Repository和Tag字段，Quadlet支持更多选项和新搜索路径，podman create/run支持nocreate卷选项和AMD GPU，容器可设置多个静态IP地址，新增多个API和事件支持，以及实验性的rootless端口转发选项。其他变更涉及虚拟机挂载方式、默认提供者更改、构建镜像时的上下文目录处理等。修复了大量错误，涉及Quadlet、虚拟机、容器健康检查、卷挂载、网络和API端点等方面。API文档得到改进，Docker兼容API版本升至v1.44，多个端点功能增强并修复了若干问题。依赖库已更新至相应新版本。

更新内容 （中文）

安全

  • 本次发布修复了CVE-2026-57231，该漏洞中恶意镜像可利用格式错误的Env条目导致主机环境变量泄露到基于该镜像运行的容器中，包括使用*通配符在不了解确切名称的情况下泄露大量环境变量的可能性（GHSA-4hq8-gpf5-8p68）。
  • 本次发布修复了CVE-2026-19730，其中podman quadlet install --replace命令未截断被替换的文件，导致用较短文件替换较长文件时会错误地保留原始文件内容。

破坏性变更

  • 由于本次发布存在破坏性变更，Podman v6.0.0必须与Buildah v1.44.0、Skopeo v1.23、Netavark和Aardvark v2.0.0以及容器库仓库common/v0.68.0版本的配置文件一起使用。
  • 已移除对BoltDB数据库的支持。当使用BoltDB数据库启动Podman 6时，Podman将尝试自动从BoltDB迁移到SQLite。
  • 已移除对在Intel Mac上运行的支持。
  • 已移除对在Windows 10上运行的支持。
  • 已移除对在cgroups v1系统上运行的支持。请更新系统使用cgroups v2。
  • 已移除对在iptables上运行的支持。请改用nftables。
  • 已移除对CNI网络的支持。请改用Netavark。
  • 已移除对slirp4netns无根网络栈的支持。请改用Pasta。作为此项变更的一部分，仅用于slirp4netns的--network-cmd-path全局选项已被移除。
  • Podman的配置文件解析逻辑经过重大重写。确切细节请参见此文档。
  • Podman的导入路径已从github.com/containers/podman/v5更改为go.podman.io/podman/v6，这是我们迁移到CNCF拥有GitHub组织的一部分。
  • 网络隔离现在默认启用，提高了Docker兼容性和安全性。已移除与禁用隔离相关的Docker兼容API的特殊解决方案（#27349）。
  • podman quadlet系列命令的功能方式已更改。以前，Quadlet及其关联文件通过.app文件跟踪，确保删除Quadlet时也会删除所有关联的非Quadlet文件。现在，Quadlet及其关联文件放置在子目录中，这应能减少错误并使手动管理通过podman quadlet install添加的Quadlet更加容易。
  • Linux上由podman machine创建的虚拟机现在使用systemd挂载主机卷。此更改破坏了Linux上现有podman machine虚拟机的卷挂载，需要重新创建虚拟机。
  • podman volume prune命令现在与Docker行为一致，仅清理未使用的匿名卷。请使用新增的--all选项获取之前的行为（清理所有卷）。
  • podman volume list命令现在使用逻辑AND而非逻辑OR组合多个过滤器（意味着所有过滤器都必须匹配才能将容器包含在输出中）（#26786）。
  • 许多命令中使用的label!=过滤器现在使用逻辑AND而非逻辑OR组合多个过滤器实例的输出。
  • podman ps、podman pod ps和podman volume ls命令的--format='{{json .Labels}}选项现在以逗号分隔的key=value对而非JSON映射打印其输出，提高了Docker兼容性（#21847）。
  • podman machine list的--all-providers选项已被移除，因为现在所有命令都可以访问来自所有提供程序的虚拟机。
  • podman inspect的MemorySwappiness字段在用户未明确设置时现在设置为nil（而不是-1），提高了Docker兼容性（#23824）。
  • podman commit命令现在在提交更改时暂停容器，通过限制并发修改来提高安全性。可以使用podman commit --pause=false ...恢复之前的行为。
  • REST API的Go绑定已从artifacts.Remove()函数中移除了多余的nameOrID参数。
  • 构建Podman所需的最低Go版本现在为v1.25。

功能

  • 所有podman machine命令现在可以对来自所有提供程序的虚拟机进行操作，无论当前提供程序设置为何。配置中设置的提供程序仅确定新创建虚拟机使用的提供程序，并且可以通过新的podman machine init --provider选项覆盖。这应使混合使用applehv和libkrun虚拟机或hyperv和wsl虚拟机的Mac和Windows安装操作变得更加容易。
  • 新增命令podman machine os update，用于更新podman machine虚拟机的操作系统。请注意，此命令不支持wsl提供程序。
  • 新增命令podman system hyperv-prep，允许Windows管理员为主机准备环境，以便用户使用hyperv提供程序运行podman machine虚拟机。
  • 使用podman machine start和podman machine init --now启动虚拟机时，如果该虚拟机的连接不是默认连接，系统将提示用户是否要将默认连接更改为刚刚启动的虚拟机。这也可以通过新选项--update-connection控制，该选项控制是否更新默认设置。如果设置了--update-connection选项，则不会显示用户交互式提示。
  • podman machine init和podman machine set命令现在支持新选项--import-native-ca，设置后会使Windows、Linux和Mac上的podman machine虚拟机在每次启动时导入主机的受信任CA证书。
  • podman exec命令现在有一个新选项--no-session，禁用API会话跟踪和数据库操作以提高性能（#26727）。
  • podman image list --format json命令现在为每个镜像包含两个新字段Repository和Tag（#27632）。
  • Quadlet的手册页已拆分为多个文件，每个Quadlet文件类型一个文件，可读性应大大增强。
  • Quadlet .volume单元现在支持三个新键：UID=和GID=（用于设置创建卷时使用的UID和GID）以及Options=（用于设置通用卷选项）。
  • Quadlet .container单元现在支持挂载匿名卷（使用未指定源的Mount=键）（#28497）。
  • 已为Quadlet添加两个新搜索路径：/usr/share/containers/systemd/users和/usr/share/containers/systemd/users/${UID}，允许发行版更轻松地打包和分发Quadlet（#27843）。
  • podman quadlet list命令现在有一个新别名podman quadlet ls。
  • podman quadlet list命令现在有一个新选项--noheading，用于禁用打印表格标题。如果使用--format选项则自动设置此选项。
  • pomdan quadlet list命令现在在其输出中包含一个新字段Pod，用于打印Quadlet .container单元所属的pod。
  • podman quadlet list命令的--filter选项现在支持新过滤器status=（#28369）。
  • podman create和podman run的--gpus选项现在与AMD GPU兼容。
  • podman create、podman run和podman pod create命令现在可以使用新选项nocreate指定卷（例如podman run --mount type=volume,src=myvol,dst=/mnt,nocreate），如果指定的卷不存在则会报错，而不是创建它。
  • podman run和podman create的--log-opt选项现在支持新选项label=，用于向记录的消息附加额外标签（仅与journald日志驱动程序一起使用）。
  • 许多Podman命令现在提供--tls-details选项，允许使用containers-tls-details.yaml(5)文件自定义调整TLS设置。
  • 容器的died事件现在提供新属性OOMKilled，如果设置则表示容器因内存不足而停止（#26701）。
  • 容器现在可以通过多次向--net传递ip=选项来设置多个静态IP地址（例如--net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4）。
  • podman volume prune命令现在包含新选项--all，用于清理所有未使用的卷，而不仅是匿名卷（#24597）。
  • podman volume prune命令现在包含新选项--dry-run，返回将被删除但实际不删除的卷（#27838）。
  • podman image scp命令现在包含新选项--format，用于设置镜像传输使用的归档格式（#28183）。
  • 已在containers.conf中添加新字段default_host_ips，用于设置用户未指定IP时端口转发的默认主机IP（#27186）。
  • podman image trust系列命令现在支持新选项--signature-policy，该选项对podman image trust set是必需的。
  • 事件现在包含制品生命周期事件（create、pull、push和remove）（#27260）。
  • 已在containers.conf的rootless_port_forwarder字段中添加新实验选项rootless_port_forwarder=\"pasta\"。设置后，无根桥接网络将使用Pasta通过Pesto的内核级端口转发而非rootlessport，在无根容器的网络流量中保留原始客户端源IP。默认值仍为rootlessport（Podman 5.x的默认值），但我们将在稳定性更确定时调查切换。
  • 已为podman ps和podman container prune命令添加新过滤器--filter annotation=，用于根据注释过滤容器（#28562）。
  • podman network create命令的--route选项现在可以创建黑洞、不可达和禁止路由，以防止容器访问某些网络（例如podman network create --route 10.20.30.40/24,blackhole ...）（#20022）。
  • 在podman网络中添加对黑洞、不可达和禁止路由类型的支持。自netavark 2.0起支持。
  • podman info命令现在报告CDI规范目录和发现的CDI设备。
  • pod和卷生成的事件现在包含pod/卷的标签作为属性，与容器事件的行为匹配（#26480）。

变更

  • podman machine创建的虚拟机现在将主机的用户配置（例如Linux上的~/.config/containers）挂载到虚拟机的/etc/containers，允许用户直接编辑控制Podman行为的配置文件。
  • Mac上的默认podman machine提供程序已更改为libkrun。
  • 在Windows上使用hyperv提供程序启动和停止podman machine虚拟机不再需要管理员权限（创建虚拟机仍然需要管理员权限）。需要提升权限的操作将提示管理员访问。请注意，此功能仅适用于新创建的虚拟机。
  • podman pod inspect命令现在以确定性顺序打印输出中的数组。
  • podman machine os apply命令已更新，现在使用bootc switch应用更改。所有bootc switch支持的传输方式都可用于应用新镜像。
  • 已添加实验功能，在使用内核6.18及更新版本的系统上，无根Podman将不再需要创建暂停进程来保持无根用户命名空间打开，而是使用nsfs文件句柄。此行为目前通过环境变量drop-pause-process设置来控制。
  • 使用--net=host创建的容器现在将使用127.0.0.1作为其host.containers.internal地址，而不是机器的公共IP（#27823）。
  • 多个网络中的容器现在根据在命令行上传递的顺序以确定性顺序配置这些网络。
  • 使用进程替换构建镜像时（例如podman build -f <(<<<\"FROM scratch\")），现在使用空临时目录作为上下文目录（#28113）。
  • 在Podman 5.x及更早版本中，镜像ID（对于OCI和Docker v2s2镜像）始终等于镜像配置数据的SHA256摘要。Podman的未来版本将添加对非SHA256摘要的支持，对于未使用SHA256摘要的镜像，镜像ID格式将发生变化。新ID的确切格式尚未确定，但在未来的Podman版本中，镜像ID是有效哈希的假设将不再成立。

错误修复

  • 修复了从模板.container文件创建属于pod的Quadlet时，会错误地将容器使用的模板依赖添加到pod的错误（#27844）。
  • 修复了Quadlet .pod文件即使在用户指定替代重启策略时也会无条件设置Restart=on-failure的错误（#28081）。
  • 修复了在Windows上使用hyperv提供程序启动podman machine虚拟机时，如果虚拟机首次启动失败则启动失败的错误（#27930）。
  • 修复了podman machine init和podman machine set允许创建CPU数多于主机可用CPU数的虚拟机，导致无法启动虚拟机的错误（#28322）。
  • 修复了制品卷仅在容器启动时检查制品有效性，允许创建引用不存在制品（因此永远无法启动）的容器的错误（#27747）。
  • 修复了在某些情况下具有环境密钥的容器在重启后可能丢失密钥值的错误（#28075）。
  • 修复了podman container restore --publish命令在未与--import选项或检查点镜像一起使用时静默忽略--publish选项而非报错的错误。
  • 修复了在Windows上使用wsl提供程序无法运行嵌套无根Podman容器的错误（#27411）。
  • 修复了podman container clone命令对使用环境密钥（--secret type=env,...）创建的容器失败的错误（#28130）。
  • 修复了当选择非journald的日志驱动程序时，允许使用tag=日志选项（--log-opt tag=mytag）创建容器的错误。
  • 修复了某些命令的--help输出格式错误的错误（#28178）。
  • 修复了具有多个卷挂载的pod中的容器可能将一个卷挂载的挂载选项泄漏到其他挂载的错误。
  • 修复了远程Podman客户端的podman version命令在无法连接服务器（例如podman machine虚拟机已关闭）时报错的错误。在这种情况下，现在会打印客户端版本（#28222）。
  • 修复了无根Podman在暂停进程被终止且其PID被回收给另一个进程时显示错误并拒绝启动的错误（#28157）。
  • 修复了在对包含名称中带.字符的卷的容器运行podman kube generate时生成无效YAML的错误（#27620）。
  • 修复了在远程构建期间，.containerignore和.dockerignore文件中以斜杠开头或结尾的模式被静默忽略的错误（#25458）。
  • 修复了使用--transient-store选项创建的容器的健康检查失败的错误（#28483）。
  • 修复了在没有基础容器的pod上运行podman generate spec命令时出现panic的错误（#21609）。
  • 修复了podman container inspect命令可能对其输出中的某些字符进行HTML转义的错误（#28560）。
  • 修复了包含多个容器且条目已添加到/etc/hosts的pod在任一容器停止时会错误地移除所有容器的/etc/hosts条目的错误。
  • 修复了没有/dev/mqueue的主机可能无法启动容器，因为Podman试图无条件添加设备的错误。
  • 修复了检查未设置网关的网络时将网关显示为<nil>而非不显示任何内容的错误（#28705）。
  • 修复了允许创建包含重复主机端口的端口映射的容器或pod，但由于端口冲突此配置永远无法启动的错误。
  • 修复了远程Podman客户端无法连接到用户SSH配置中具有自定义HostName的主机的错误（#25067）。
  • 修复了podman inspect --type=all命令在尝试检查多个网络时仅输出其中一个网络多次的错误。
  • 修复了使用http_proxy=true设置的Quadlet .container文件在创建systemd单元文件时未正确转义添加到容器的环境变量中的特殊字符的错误（#28698）。
  • 修复了使用远程Podman客户端创建的容器忽略containers.conf中log_path设置的错误（#28792）。
  • 修复了远程Podman客户端的podman save命令在Linux上使用-f oci-dir或-f docker-dir参数时失败的错误。
  • 修复了Linux上的podman machine虚拟机无法将符号链接路径下的目录挂载到虚拟机中的错误（#28911）。
  • 修复了podman container checkpoint --leave-running命令可能生成不一致检查点的错误，因为在允许进程运行一段时间后才执行rootfs和命名卷差异；容器现在暂停直到检查点完全完成。
  • 修复了podman kube play命令在用户将限制指定为分式BinarySI数量（例如1.5Gi）时错误设置内存限制的错误（#28789）。

API

  • 已对API文档进行改进，记录了缺失文档的字段。敬请期待未来版本中更多的API文档改进！
  • 支持的Docker兼容API版本已升级到v1.44。
  • 所有接受JSON主体参数的API请求在提供空主体时将不再报错。
  • 容器的Compat列表端点现在在其输出中包含新字段Health，提供容器健康检查状态信息（#27786）。
  • 新增API POST /libpod/local/artifacts/add，用于从本地系统加载制品（无需传输tarball）。
  • 用于从本地系统加载镜像的POST /libpod/local/images端点现在要求path查询参数为绝对路径而非相对路径。
  • 镜像的Libpod拉取端点现在在pullProgress查询参数设置为true时可报告拉取进度。
  • 镜像的Libpod拉取端点现在在拉取镜像失败时返回错误状态码，而不是始终返回HTTP 200。
  • 修复了创建容器时忽略卷的subpath选项的错误（#27171）。
  • 修复了容器的Libpod创建端点忽略OCIRuntime字段的错误。
  • 修复了容器的Compat创建端点在尝试创建名称已被使用的容器时返回500（而非409）的错误。
  • 修复了容器的Compat创建端点错误处理HostConfig.Devices中的CDI限定条目的错误，大大提高了使用Compat API时CDI设备的可靠性。
  • 修复了Compat信息端点在未使用默认配置文件时不返回Seccomp配置文件位置的错误（#28379）。
  • 修复了容器的Compat列表端点可能返回容器状态的无效字符串的错误（#28359）。
  • 修复了容器的Compat列表端点未在其响应中包含HostConfig字段的错误。
  • 修复了容器的Compat等待端点在等待next-exit条件时无限期挂起的错误（#28514）。
  • 修复了容器的Compat和Libpod更新端点在API请求中未明确设置rlimits时会清除容器rlimits的错误。
  • 修复了镜像的Compat推送端点未像Docker那样返回包含推送镜像标签、摘要和大小的最终JSON对象的错误。

其他

  • 已为使用podman inspect检查制品启用自动补全。
  • 更新Buildah到v1.44.0
  • 更新镜像库到v5.40.0
  • 更新存储库到v1.63.0
  • 更新common库到v0.68.0

更新内容 （原始）

Security

  • This release addresses CVE-2026-57231, where a malicious image using malformed Env entries could cause host environment variables to leak into containers run based on the image, including the ability to use the * glob operator to leak large numbers of environment variables without knowing their exact names (GHSA-4hq8-gpf5-8p68).
  • This release addresses CVE-2026-19730 where the podman quadlet install --replace command did not truncate the file being replaced, meaning replacing a longer file with a shorter one would result in content from the original file incorrectly being retained.

Breaking Changes

  • Due to breaking changes in this release, Podman v6.0.0 must be used with Buildah v1.44.0, Skopeo v1.23, Netavark and Aardvark v2.0.0, and configuration files from the container-libs repository’s common/v0.68.0 release.
  • Support for BoltDB databases has been dropped. Starting Podman 6 when the BoltDB database is in use will have Podman attempt an automatic migration from BoltDB to SQLite.
  • Support for running on Intel Macs has been removed.
  • Support for running on Windows 10 has been removed.
  • Support for running on cgroups v1 systems has been removed. Please update your system to use cgroups v2.
  • Support for running on iptables has been removed. Please use nftables instead.
  • Support for CNI networking has been removed. Please use Netavark instead.
  • Support for the slirp4netns rootless network stack has been removed. Please use Pasta instead. As part of this, the --network-cmd-path global option, only used with slirp4netns, has been removed.
  • Podman’s configuration file parsing logic has seen a major rewrite. Please see this document for exact details.
  • Podman’s import path has changed from github.com/containers/podman/v5 to go.podman.io/podman/v6 as part of our move into a CNCF-owned GitHub organization.
  • Network isolation now defaults to enabled, improving Docker compatibility and security. A special workaround for the Docker-compatible API related to isolation being disabled has been removed (#27349).
  • The way the podman quadlet suite of commands functions has been changed. Previously, Quadlets and their associated files were tracked using a .app file, ensuring that removing a Quadlet also removed all associated non-Quadlet files. Now, Quadlets and associated files are placed in subdirectories, which should reduce bugs and make manual management of Quadlets added by podman quadlet install much easier.
  • VMs made by podman machine on Linux now mount volumes from the host using systemd. Volume mounts on existing podman machine VMs on Linux have been broken by this change, and the VM will need to be recreated.
  • The podman volume prune command now matches Docker’s behavior by only pruning unused anonymous volumes. Please use the newly-added --all option for the previous behavior (pruning all volumes).
  • The podman volume list command now combines multiple filters using logical AND instead of logical OR (meaning all filters must match for a container to be included in output) (#26786).
  • The label!= filter used in many commands now combines the output of multiple instances of the filter with logical AND instead of logical OR.
  • The --format='{{json .Labels}} option to the podman ps, podman pod ps, and podman volume ls commands now prints its output as comma-separated key=value pairs instead of as a JSON map, improving Docker compatibility (#21847).
  • The --all-providers option to podman machine list has been removed, as machines from all providers can now be accessed by all commands.
  • The MemorySwappiness field of podman inspect is now set to nil when not explicitly set by the user (instead of -1), improving Docker compatibility (#23824).
  • The podman commit command now pauses the container while committing changes, improving security by restricting concurrent modification. The prior behavior can be restored by using podman commit --pause=false ....
  • The Go bindings for the REST API have removed the redundant nameOrID parameter from the artifacts.Remove() function.
  • The minimum Go version required to build Podman is now v1.25.

Features

  • All podman machine commands can now operate on VMs from all providers, regardless of what the current provider is set to. The provider set in the configuration only determines the provider used by newly-created VMs, and can be overridden by the new podman machine init --provider option. This should make operation of Mac and Windows installs mixing use of applehv and libkrun VMs, or hyperv and wsl VMs, much easier.
  • A new command has been added, podman machine os update, which updates the operating system of a podman machine VM. Please note that this is not supported with the wsl provider.
  • A new command has been added, podman system hyperv-prep, allowing Windows administrators to prepare a host for their users to run podman machine VMs using the hyperv provider.
  • When starting a VM with podman machine start and podman machine init --now, if the connection to that VM is not the default, users will be prompted whether they want to change the default to the machine that was just started. This can also be controlled by a new option, --update-connection, which controls whether the default will be updated. If the --update-connection option is set, a user-interactive prompt is not displayed.
  • The podman machine init and podman machine set commands now support a new option, --import-native-ca, which, when set, causes podman machine VMs on Windows, Linux, and Mac to import the host’s trusted CA certificates each time the VM boots.
  • The podman exec command now has a new option, --no-session, disabling API session tracking and database operations to increase performance (#26727).
  • The podman image list --format json command now includes two new fields for each image, Repository and Tag (#27632).
  • The manpages for Quadlets have been split into multiple files, one for each type of Quadlet file, and should be much more readable.
  • Quadlet .volume units now support three new keys, UID= and GID= (to set the UID and GID that the volume will be created with) and Options= (to set generic volume options).
  • Quadlet .container units now support mounting anonymous volumes (using a Mount= key with no source specified) (#28497).
  • Two new search paths for Quadlets have been added, /usr/share/containers/systemd/users and /usr/share/containers/systemd/users/${UID}, to allow distributions to more easily package and distribute Quadlets (#27843).
  • The podman quadlet list command now has a new alias, podman quadlet ls.
  • The podman quadlet list command now has a new option, --noheading, which disables printing the table header. This is set automatically if the --format option is used.
  • The pomdan quadlet list command now includes a new field in its output, Pod, which prints the pod a Quadlet .container unit is part of.
  • The podman quadlet list command’s --filter option now supports a new filter, status= (#28369).
  • The --gpus option to podman create and podman run is now compatible with AMD GPUs.
  • The podman create, podman run, and podman pod create commands can now specify volumes with a new option, nocreate (e.g. podman run --mount type=volume,src=myvol,dst=/mnt,nocreate) which will error if the specified volume does not exist, instead of creating it.
  • The --log-opt option to the podman run and podman create now supports a new option, label=, to attach additional labels to logged messages (only usable with the journald log driver).
  • Many Podman commands now expose a --tls-details option, allowing custom tuning of TLS settings using a containers-tls-details.yaml(5) file.
  • The died event for Containers now exposes a new attribute, OOMKilled, which (if set) indicates the container was stopped due to running out of memory (#26701).
  • Containers can now set multiple static IP addresses by passing the ip= option to --net multiple times (e.g. --net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4).
  • The podman volume prune command now includes a new option, --all, to prune all unused volumes, not just anonymous volumes (#24597).
  • The podman volume prune command now includes a new option, --dry-run, which returns the volumes that would be removed but does not actually remove them (#27838).
  • The podman image scp command now includes a new option, --format, to set the archive format used for the image transfer (#28183).
  • A new field has been added to containers.conf, default_host_ips, to set the default host IP that ports are forwarded from if an IP is not specified by the user (#27186).
  • The podman image trust suite of commands now support a new --signature-policy option, which is mandatory for podman image trust set.
  • Events now include artifact lifecycle events (create, pull, push, and remove) (#27260).
  • A new experimental option for the rootless_port_forwarder field in containers.conf has been added, rootless_port_forwarder="pasta". When set, rootless bridge networks will use Pasta’s kernel-level port forwarding via Pesto instead of rootlessport, preserving the original client source IP in network traffic in rootless containers. The default remains rootlessport (the default for Podman 5.x), but we will investigate switching at a later date when stability is more certain.
  • A new filter has been added to the podman ps and podman container prune commands, --filter annotation=, to filter containers based on their annotations (#28562).
  • The podman network create command’s --route option can now create blackhole, unreachable, and prohibit routes to prevent containers from reaching certain networks (e.g. podman network create --route 10.20.30.40/24,blackhole ...) (#20022).
  • Add support for blackhole, unreachable, and prohibit route types in podman networks. Supported since netavark 2.0.
  • The podman info command now reports CDI spec directories and discovered CDI devices.
  • Events generated by pods and volumes now include the pod/volume’s labels as attributes, matching the behavior of container events (#26480).

Changes

  • VMs created by podman machine now mount the host’s user configurations (e.g. ~/.config/containers on Linux) into the machine at /etc/containers, allowing users to edit the config files controlling Podman’s behavior directly.
  • The default podman machine provider on Macs has been changed to libkrun.
  • Starting and stopping podman machine VMs on Windows with the hyperv provider no longer requires administrator privileges (creating machines still requires admin, however). Operations requiring elevated privileges will prompt for administrator access. Please note that this only works with newly-created VMs.
  • The podman pod inspect command now prints arrays in its output in deterministic order.
  • The podman machine os apply command has been updated, and now uses bootc switch to apply changes. All transports supported by bootc switch can be used for the new image to apply.
  • An experimental feature has been added where, on systems using Kernel 6.18 and newer, rootless Podman will no longer need to create a pause process to hold open the rootless user namespace, instead using an nsfs file handle. This behavior is currently gated behind an environment variable, drop-pause-process, being set.
  • Containers created with --net=host will now use 127.0.0.1 for their host.containers.internal address, instead of a public IP of the machine (#27823).
  • Containers in multiple networks now have these networks configured in a deterministic order based on the order they were passed on the command line.
  • When building an image with process substitution, such as podman build -f <(<<<"FROM scratch") , an empty temporary directory is now used as the context directory (#28113).
  • In Podman versions 5.x and under, image IDs (for both OCI and Docker v2s2 images) were always equal to the SHA256 digest of the image’s config data. A future version of Podman will add support for non-SHA256 digests, and image ID format will change for images that are not using the SHA256 digest. The exact format of the new IDs has not yet been decided, but the assumption that image IDs are valid hashes will no longer be true in future Podman versions.

Bugfixes

  • Fixed a bug where creating a Quadlet from a templated .container file that was part of a pod would incorrectly add a dependency on the template used for the container to the pod (#27844).
  • Fixed a bug where Quadlet .pod files would unconditionally set Restart=on-failure even when the user specified an alternative restart policy (#28081).
  • Fixed a bug where starting a podman machine VM on Windows using the hyperv provider would fail if the machine failed to start on first boot (#27930).
  • Fixed a bug where podman machine init and podman machine set allowed creating VMs with more CPUs than were available on the host, creating VMs that could not be started (#28322).
  • Fixed a bug where artifact volumes only checked the validity of the artifact when the container was started, allowing containers to be created that referenced artifacts which did not exist and thus could never be started (#27747).
  • Fixed a bug where containers with environment secrets could lose the value of the secret after a restart under some circumstances (#28075).
  • Fixed a bug where the podman container restore --publish command would silently ignore the --publish option instead of erroring when used without the --import option or a checkpoint image.
  • Fixed a bug where running nested rootless Podman containers on Windows using the wsl provider was not possible (#27411).
  • Fixed a bug where the podman container clone command would fail with containers created with environment secrets (--secret type=env,...) (#28130).
  • Fixed a bug where creating a container with the tag= log option (--log-opt tag=mytag) was allowed when a log driver other than journald was selected.
  • Fixed a bug where the output of --help with some commands was incorrectly formatted (#28178).
  • Fixed a bug where containers in pods with multiple volume mounts could have mount options from one volume mount leak to other mounts.
  • Fixed a bug where the remote Podman client’s podman version command would error if the server could not be connected to (e.g. the podman machine VM was shut down). In this case, client version is now printed (#28222).
  • Fixed a bug where rootless Podman would display errors and refuse to launch if the pause process was killed and its PID recycled to another process (#28157).
  • Fixed a bug where running podman kube generate on a container including volumes with . characters in their names produced invalid YAML (#27620).
  • Fixed a bug where patterns in .containerignore and .dockerignore files that began or ended with slashes were silently ignored during remote builds (#25458).
  • Fixed a bug where healthchecks on containers created using the --transient-store option would fail (#28483).
  • Fixed a bug where the podman generate spec command would panic when run on a pod with no infra container (#21609).
  • Fixed a bug where the podman container inspect command could HTML-escape certain characters in its output (#28560).
  • Fixed a bug where pods with entries added to /etc/hosts containing multiple containers would incorrectly remove entries from /etc/hosts for all containers in the pod when any container stopped.
  • Fixed a bug where hosts without /dev/mqueue could be unable to start containers as Podman attempted to add the device unconditionally.
  • Fixed a bug where inspecting networks without a gateway set would show the gateway as <nil> instead of the showing nothing (#28705).
  • Fixed a bug where creating a container or pod with port mappings including duplicated host ports was allowed, when this configuration could never be started due to the port conflict.
  • Fixed a bug where the remote Podman client was unable to connect to any host with a custom HostName in the user’s SSH config (#25067).
  • Fixed a bug where the podman inspect --type=all command would, when attempting to inspect multiple networks, output only one of the networks multiple times.
  • Fixed a bug where Quadlet .container files using the http_proxy=true setting did not properly escape special characters in the environment variables added to the container when creating the systemd unit file (#28698).
  • Fixed a bug where containers created using the remote Podman client ignored the log_path setting in containers.conf (#28792).
  • Fixed a bug where the remote Podman client’s podman save command would fail on Linux when using the -f oci-dir or -f docker-dir arguments.
  • Fixed a bug where podman machine VMs on Linux would fail to mount the directories under a symlinked path into the VM (#28911).
  • Fixed a bug where the podman container checkpoint --leave-running command could produce inconsistent checkpoints because the rootfs and named volume diffs were performed after the processes were allowed to run for a time; the container is now paused until the checkpoint is fully complete.
  • Fixed a bug where the podman kube play command would incorrectly set memory limits if the user specified the limit as a fractical BinarySI quantity (e.g. 1.5Gi) (#28789).

API

  • An improvement pass has been made over API documentation to document fields which were missing documentation. Look forward to more API documentation improvements in future releases!
  • The supported Docker Compatible API version has been bumped to v1.44.
  • All API requests that accept JSON body parameters will no longer error if an empty body is provided.
  • The Compat List endpoint for Containers now includes a new field in its output, Health, providing information on the status of the container’s healthcheck (#27786).
  • Added a new API, POST /libpod/local/artifacts/add, for loading artifacts from the local system (not requiring transmission of a tarball).
  • The POST /libpod/local/images endpoint for loading images from the local system now requires that the path query parameter is an absolute path, not a relative path.
  • The Libpod Pull endpoint for Images can now report pull progress when the pullProgress query parameter is set to true.
  • The Libpod Pull endpoint for Images now returns error status codes on failure to pull imges, instead of always returning HTTP 200.
  • Fixed a bug where the subpath option for volumes when creating containers was ignored (#27171).
  • Fixed a bug where the Libpod Create endpoint for Containers ignored the OCIRuntime field.
  • Fixed a bug where the Compat Create endpoint for Containers returned a 500 (not a 409) when attempting to create a container with a name that was already in use.
  • Fixed a bug where the Compat Create endpoint for Containers incorrectly handled CDI-qualified entries in HostConfig.Devices, greatly improving the reliability of CDI devices when using the Compat API.
  • Fixed a bug where the Compat Info endpoint did not return the location of the Seccomp profile if a non-default profile was in use (#28379).
  • Fixed a bug where the Compat List endpoint for Containers could return an invalid string for container status (#28359).
  • Fixed a bug where the Compat List endpoint for Containers did not include the HostConfig field in its responses.
  • Fixed a bug where the Compat Wait endpoint for Containers would hang indefinitely when waiting for the next-exit condition (#28514).
  • Fixed a bug where the Compat and Libpod Update endpoints for Containers would clear the rlimits of the container if they were not explicitly set in the API request.
  • Fixed a bug where the Compat Push endpoint for Images did not return a final JSON object including tag, digest, and size of the pushed image, as Docker does.

Misc

  • Autocomplete has been enabled for inspecting artifacts with podman inspect.
  • Updated Buildah to v1.44.0
  • Updated the image library to v5.40.0
  • Updated the storage library to v1.63.0
  • Updated the common library to v0.68.0

下载链接