Podman 5.0.0 4.9.4 und 5.0.1 Security und Bugfix Releases

Die Open-Source Container Engine Podman / Pod-Manager von Red hat, die im Gegensatz zu Docker ohne Daemon als Steuerungsinstanz auskommt und ohne Root Rechte den Zugriff auf virtualisierte Anwendungen ermögilcht, wurde vor wenigen Wochen in Version 5.0.0 sowie 4.9. und vor kurzem in Version 5.0.1 veröffentlicht.

Podman 5.0.1 Release Notes

Bugfixes

• Fixed a bug where rootless containers using the Pasta network driver did not properly handle localhost DNS resolvers on the host leading to DNS resolution issues (#22044).
• Fixed a bug where Podman would warn that cgroups v1 systems were no longer supported on FreeBSD hosts.
• Fixed a bug where HyperV podman machine VMs required an SSH client be installed on the system (#22075).
• Fixed a bug that prevented the remote Podman client’s podman build command from working properly when connecting from a rootless client to a rootful server (#22109).

Misc

• The HyperV driver to podman machine now fails immediately if admin privileges are not available (previously, it would only fail when it reached operations that required admin privileges).

Podman 4.9.4 Release Notes

Security

• Fixed CVE-2024-1753 in Buildah and podman build which allowed a user to write files to the / directory of the host machine if selinux was not enabled.

Bugfixes

• Fixed a bug where health check status would be updated to “healthy” before the startup delay had expired.

Podman 5.0.0 Release Notes

Security

• Fixed CVE-2024-1753 in Buildah and podman build which allowed a user to write files to the / directory of the host machine if selinux was not enabled.

Features

• VMs created by podman machine can now use the native Apple hypervisor (applehv) when run on MacOS.
• A new command has been added, podman machine reset, which will remove all existing podman machine VMs and relevant configurations.
• The podman manifest add command now supports a new --artifact option to add OCI artifacts to a manifest list.
• The podman create, podman run, and podman push commands now support the --retry and --retry-delay options to configure retries for pushing and pulling images.
• The podman run and podman exec commands now support a new option, --preserve-fd, which allows passing a list of file descriptors into the container (as an alternative to --preserve-fds, which passes a specific number of file descriptors).
• Quadlet now supports templated units (#17744).
• The podman kube play command can now create image-based volumes using the volume.podman.io/image annotation.
• Containers created with podman kube play can now include volumes from other containers (similar to the --volumes-from option) using a new annotation, io.podman.annotations.volumes-from (#16819).
• Pods created with podman kube play can now set user namespace options through the the io.podman.annotations.userns annotation in the pod definition (#20658).
• Macvlan and ipvlan networks can adjust the name of the network interface created inside containers via the new containers.conf field interface_name (#21313).
• The --gpus option to podman create and podman run is now compatible with Nvidia GPUs (#21156).
• The --mount option to podman create and podman run supports a new mount option, no-dereference, to mount a symlink (instead of its dereferenced target) into a container (#20098).
• Podman now supports a new global option, --config, to point to a Docker configuration where we can source registry login credentials.
• The podman ps --format command now supports a new format specifier, .Label (#20957).
• The uidmapping and gidmapping options to the podman run --userns=auto option can now map to host IDs by prefixing host IDs with the @ symbol.
• Quadlet now supports systemd-style drop-in directories.
• Quadlet now supports creating pods via new .pod unit files (#17687).
• Quadlet now supports two new keys, Entrypoint and StopTimeout, in .container files (#20585 and #21134).
• Quadlet now supports specifying the Ulimit key multiple times in .container files to set more than one ulimit on a container.
• Quadlet now supports setting the Notify key to healthy in .container files, to only sdnotify that a container has started when its health check begins passing (#18189).

Breaking Changes

• The backend for the podman machine commands has seen extensive rewrites. Configuration files have changed format and VMs from Podman 4.x and earlier are no longer usable. podman machine VMs must be recreated with Podman 5.
• The podman machine init command now pulls images as OCI artifacts, instead of using HTTP. As a result, a valid policy.json file is required on the host. Windows and Mac installers have been changed to install this file.
• QEMU is no longer a supported VM provider for podman machine on Mac. Instead, the native Apple hypervisor is supported.
• The ConfigPath and Image fields are no longer provided by the podman machine inspect command. Users can also no longer use {{ .ConfigPath }} or {{ .Image }} as arguments to podman machine inspect --format.
• The output of podman inspect for containers has seen a number of breaking changes to improve Docker compatibility, including changing Entrypoint from a string to an array of strings and StopSignal from an int to a string.
• The podman inspect command for containers now returns nil for healthchecks when inspecting containers without healthchecks.
• The podman pod inspect command now outputs a JSON array regardless of the number of pods inspected (previously, inspecting a single pod would omit the array).
• It is no longer possible to create new BoltDB databases; attempting to do so will result in an error. All new Podman installations will now use the SQLite database backend. Existing BoltDB databases remain usable.
• Support for CNI networking has been gated by a build tag and will not be enabled by default.
• Podman will now print warnings when used on cgroups v1 systems. Support for cgroups v1 is deprecated and will be removed in a future release. The PODMAN_IGNORE_CGROUPSV1_WARNING environment variable can be set to suppress warnings.
• Network statistics sent over the Docker API are now per-interface, and not aggregated, improving Docker compatibility.
• The default tool for rootless networking has been swapped from slirp4netns to pasta for improved performance. As a result, networks named pasta are no longer supported.
• The --image option replaces the now deprecated --image-path option for podman machine init.
• The output of podman events --format "{{json .}}" has been changed to improve Docker compatibility, including the time and timeNano fields (#14993).
• The name of podman machine VMs and the username used within the VM are now validated and must match this regex: [a-zA-Z0-9][a-zA-Z0-9_.-]*.
• Using multiple filters with the List Images REST API now combines the filters with AND instead of OR, improving Docker compatibility (#18412).
• The parsing for a number of Podman CLI options which accept arrays has been changed to no longer accept string-delineated lists, and instead to require the option to be passed multiple times. These options are --annotation to podman manifest annotate and podman manifest add, the --configmap, --log-opt, and --annotation options to podman kube play, the --pubkeysfile option to podman image trust set, the --encryption-key and --decryption-key options to podman create, podman run, podman push and podman pull, the --env-file option to podman exec, the --bkio-weight-device, --device-read-bps, --device-write-bps --device-read-iops, --device-write-iops, --device, --label-file, --chrootdirs, --log-opt, and --env-file options to podman create and podman run, and the --hooks-dir and --module global options.

Changes

• The podman system reset command no longer waits for running containers to gracefully stop, and instead immediately sends SIGKILL (#21874).
• The podman network inspect command now includes running containers using the network in its output (#14126).
• The podman compose command is now supported on non-AMD64/ARM64 architectures.
• VMs created by podman machine will now pass HTTP proxy environment variables into the VM for all providers.
• The --no-trunc option to the podman kube play and podman kube generate commands has been deprecated. Podman now complies to the Kubernetes specification for annotation size, removing the need for this option.
• The DOCKER_HOST environment variable will be set by default for rootless users when podman-docker is installed.
• Connections from podman system connection and farms from podman farm are now written to a new configuration file called podman-connections.conf. As a result, Podman no longer writes to containers.conf. Existing connections from containers.conf will still be respected.
• Most podman farm subcommands (save for podman farm build) no longer need to connect to the machines in the farm to run.
• The podman create and podman run commands no longer require specifying an entrypoint on the command line when the container image does not define one. In this case, an empty command will be passed to the OCI runtime, and the resulting behavior is runtime-specific.
• The default SELinux label for content mounted from the host in podman machine VMs on Mac is now system_u:object_r:nfs_t:s0 so that it can be shared with all containers without issue.
• Newly-created VMs created by podman machine will now share a single SSH key key for access. As a result, podman machine rm --save-keys is deprecated as the key will persist by default.

Bugfixes

• Fixed a bug where the podman stats command would not show network statistics when the pasta network mode was used.
• Fixed a bug where podman machine VMs using the HyperV provider could not mount shares on directories that did not yet exist.
• Fixed a bug where the podman compose command did not respect the --connection and --url options.
• Fixed a bug where the podman stop -t -1 command would wait for 0 seconds, not infinite seconds, before sending SIGKILL (#21811).
• Fixed a bug where Podman could deadlock when cleaning up a container when the slirp4netns network mode was used with a restart policy of always or `unless…

Quelle: https://github.com/containers/podman/releases