podman
-
Interaction between User namespaces and Capabilities
Read more: Interaction between User namespaces and CapabilitiesUser namespaces and capabilities are important kernel functionality to make containers secure. They allow to better isolate containers and limit the privileges a container might have. A while back a user reported a bug where some odd behavior was noticed when namespaces are shared between containers which could lead to security problems. Lets take closer…
-
Podman v4.8 released!
Read more: Podman v4.8 released!We’re excited to announce that Podman v4.8.0 has been released! This release includes over 20 features and over 20 bugfixes each. Some highlights include: For a full list of changes, see our GitHub release page. Big thanks to our contributors and community! Try it out and let us know what you think! Upcoming Deprecation Notices:…
-
New Netavark firewalld reload service
Read more: New Netavark firewalld reload serviceOne longstanding problem with Podman is that your rootful containers may loose network connectivity after a while. For many users it is not be obvious what is causing such problems. Netavark configures NAT and port forwarding firewall rules. When another process is deleting our firewall rules the containers will loose connectivity. One such process is…
-
Podman’s main branch is now 5.0.0-dev
Read more: Podman’s main branch is now 5.0.0-devWe recently branched Podman 4.8 for a soon to be release. But the big news is our main branch is now 5.0.0-dev. For our users, this means a new major version of Podman has begun its genesis. What can users expect? We plan to begin releases of Podman 5.0.0 in early 2024. At this point,…
-
CNI deprecation and removal from Podman 5.0
Read more: CNI deprecation and removal from Podman 5.0As written in an earlier blog by Brent we are going to replace the older CNI stack Netavark and Aardvark-dns. With Podman 5.0 on the horizon we have decided that it will be the perfect time to drop CNI support from our upstream builds. As mentioned in the prior blog post we will most likely…
-
Why does SELinux container policy allow all Linux capabilities?
Read more: Why does SELinux container policy allow all Linux capabilities?I recently had a discussion in a container-selinux issue on why we allow certain capabilities by default for containers. The conversation is around DAC_OVERRIDE, a Linux capability which allows privileged processes, usually root, to ignore ownership and read/write permissions Discretionary Access Control (DAC). “As @wrabcak notes in Why do you see DAC_OVERRIDE SELinux denials?, In…
-
Podman Performance: Root and Rootless
Read more: Podman Performance: Root and RootlessOne of the frequent complaints I hear from users moving to Podman is about performance. I’ve always found this confusing, as the Podman team has spent significant time and effort on improving our performance, and we are quite confident that our speed is broadly comparable to Docker. Indeed, an academic paper found that Podman was…
-
Rootless Podman user-namespaces in plain English
Read more: Rootless Podman user-namespaces in plain EnglishIn my personal opinion, user-namespace are one of the most brain-twisting aspects of rootless containers to understand. Arguably right up there with Kubernetes, the learning curve can be quite steep. In this article, I will attempt to reduce that slope for new Podman users (and converts), with an easy to understand analogy. Hopefully this will…
-
New release: Podman v4.5!
Read more: New release: Podman v4.5!Podman version 4.5 was released upstream last Friday. The latest release brings a large variety of changes including bug fixes and features. Noteworthy ones being: Podman v4.5.0 is available in the stable repos for Fedora 37, 38 and rawhide and should be making its way soon into CentOS Stream and other distributions. So, please give it a…
-
Lease dynamic IPs with Netavark
Read more: Lease dynamic IPs with NetavarkAs Brent announced Netavark v1.6 with DHCP support is released, together with podman v4.5 you can now use DHCP with your macvlan networks in only a few simple steps. In order to use macvlan and DHCP you must run Podman as root. First enable the dhcp proxy via systemd socket: Now just create a macvlan…
Subscribe
Sign up with your email address to receive updates by email from this website.
Your message has been sent
Latest news
- Podman 6: machine usability improvements
- Disturbances in the force …
- Migration to the Container-Libs Monorepo is Complete
- Podman 5.6 Released: Rosetta Status Update
- Podman 5.6 Released
Categories
- Advanced (11)
- Announcement (28)
- Articles (5)
- Blog (17)
- Buildah (2)
- Community (4)
- New Feature (11)
- Newcomer (22)
- Podman (16)
- Podman Desktop (2)
- Releases (4)
- Skopeo (2)
- Tips and Tricks (19)
- Tutorials (3)
- Uncategorized (11)