de7ddf
# The containers configuration file specifies all of the available configuration
de7ddf
# command-line options/flags for container engine tools like Podman & Buildah,
de7ddf
# but in a TOML format that can be easily modified and versioned.
de7ddf
de7ddf
# Please refer to containers.conf(5) for details of all configuration options.
de7ddf
# Not all container engines implement all of the options.
de7ddf
# All of the options have hard coded defaults and these options will override
de7ddf
# the built in defaults. Users can then override these options via the command
de7ddf
# line. Container engines will read containers.conf files in up to three
de7ddf
# locations in the following order:
de7ddf
#  1. /usr/share/containers/containers.conf
de7ddf
#  2. /etc/containers/containers.conf
de7ddf
#  3. $HOME/.config/containers/containers.conf (Rootless containers ONLY)
de7ddf
#  Items specified in the latter containers.conf, if they exist, override the
de7ddf
# previous containers.conf settings, or the default settings.
de7ddf
de7ddf
[containers]
de7ddf
de7ddf
# List of annotation. Specified as
de7ddf
# "key = value"
de7ddf
# If it is empty or commented out, no annotations will be added
de7ddf
#
de7ddf
#annotations = []
de7ddf
de7ddf
# Used to change the name of the default AppArmor profile of container engine.
de7ddf
#
de7ddf
#apparmor_profile = "container-default"
de7ddf
de7ddf
# Default way to to create a cgroup namespace for the container
de7ddf
# Options are:
de7ddf
# `private` Create private Cgroup Namespace for the container.
de7ddf
# `host`    Share host Cgroup Namespace with the container.
de7ddf
#
de7ddf
#cgroupns = "private"
de7ddf
de7ddf
# Control container cgroup configuration
de7ddf
# Determines  whether  the  container will create CGroups.
de7ddf
# Options are:
de7ddf
# `enabled`   Enable cgroup support within container
de7ddf
# `disabled`  Disable cgroup support, will inherit cgroups from parent
de7ddf
# `no-conmon` Do not create a cgroup dedicated to conmon.
de7ddf
#
de7ddf
#cgroups = "enabled"
de7ddf
de7ddf
# List of default capabilities for containers. If it is empty or commented out,
de7ddf
# the default capabilities defined in the container engine will be added.
de7ddf
#
de7ddf
default_capabilities = [
de7ddf
    "NET_RAW",
de7ddf
  "CHOWN",
de7ddf
  "DAC_OVERRIDE",
de7ddf
  "FOWNER",
de7ddf
  "FSETID",
de7ddf
  "KILL",
de7ddf
  "NET_BIND_SERVICE",
de7ddf
  "SETFCAP",
de7ddf
  "SETGID",
de7ddf
  "SETPCAP",
de7ddf
  "SETUID",
de7ddf
  "SYS_CHROOT"
de7ddf
]
de7ddf
de7ddf
# A list of sysctls to be set in containers by default,
de7ddf
# specified as "name=value",
de7ddf
# for example:"net.ipv4.ping_group_range = 0 0".
de7ddf
#
de7ddf
default_sysctls = [
de7ddf
  "net.ipv4.ping_group_range=0 0",
de7ddf
]
de7ddf
de7ddf
# A list of ulimits to be set in containers by default, specified as
de7ddf
# "<ulimit name>=<soft limit>:<hard limit>", for example:
de7ddf
# "nofile=1024:2048"
de7ddf
# See setrlimit(2) for a list of resource names.
de7ddf
# Any limit not specified here will be inherited from the process launching the
de7ddf
# container engine.
de7ddf
# Ulimits has limits for non privileged container engines.
de7ddf
#
de7ddf
#default_ulimits = [
de7ddf
#  "nofile=1280:2560",
de7ddf
#]
de7ddf
de7ddf
# List of devices. Specified as
de7ddf
# "<device-on-host>:<device-on-container>:<permissions>", for example:
de7ddf
# "/dev/sdc:/dev/xvdc:rwm".
de7ddf
# If it is empty or commented out, only the default devices will be used
de7ddf
#
de7ddf
#devices = []
de7ddf
de7ddf
# List of default DNS options to be added to /etc/resolv.conf inside of the container.
de7ddf
#
de7ddf
#dns_options = []
de7ddf
de7ddf
# List of default DNS search domains to be added to /etc/resolv.conf inside of the container.
de7ddf
#
de7ddf
#dns_searches = []
de7ddf
de7ddf
# Set default DNS servers.
de7ddf
# This option can be used to override the DNS configuration passed to the
de7ddf
# container. The special value "none" can be specified to disable creation of
de7ddf
# /etc/resolv.conf in the container.
de7ddf
# The /etc/resolv.conf file in the image will be used without changes.
de7ddf
#
de7ddf
#dns_servers = []
de7ddf
de7ddf
# Environment variable list for the conmon process; used for passing necessary
de7ddf
# environment variables to conmon or the runtime.
de7ddf
#
de7ddf
#env = [
de7ddf
#  "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
de7ddf
#  "TERM=xterm",
de7ddf
#]
de7ddf
de7ddf
# Pass all host environment variables into the container.
de7ddf
#
de7ddf
#env_host = false
de7ddf
de7ddf
# Default proxy environment variables passed into the container.
de7ddf
# The environment variables passed in include:
de7ddf
# http_proxy, https_proxy, ftp_proxy, no_proxy, and the upper case versions of
de7ddf
# these. This option is needed when host system uses a proxy but container
de7ddf
# should not use proxy. Proxy environment variables specified for the container
de7ddf
# in any other way will override the values passed from the host.
de7ddf
#
de7ddf
#http_proxy = true
de7ddf
de7ddf
# Run an init inside the container that forwards signals and reaps processes.
de7ddf
#
de7ddf
#init = false
de7ddf
de7ddf
# Container init binary, if init=true, this is the init binary to be used for containers.
de7ddf
#
de7ddf
#init_path = "/usr/libexec/podman/catatonit"
de7ddf
de7ddf
# Default way to to create an IPC namespace (POSIX SysV IPC) for the container
de7ddf
# Options are:
de7ddf
# `private` Create private IPC Namespace for the container.
de7ddf
# `host`    Share host IPC Namespace with the container.
de7ddf
#
de7ddf
#ipcns = "private"
de7ddf
de7ddf
# keyring tells the container engine whether to create
de7ddf
# a kernel keyring for use within the container.
de7ddf
#
de7ddf
#keyring = true
de7ddf
de7ddf
# label tells the container engine whether to use container separation using
de7ddf
# MAC(SELinux) labeling or not.
de7ddf
# The label flag is ignored on label disabled systems.
de7ddf
#
de7ddf
#label = true
de7ddf
de7ddf
# Logging driver for the container. Available options: k8s-file and journald.
de7ddf
#
de7ddf
#log_driver = "k8s-file"
de7ddf
de7ddf
# Maximum size allowed for the container log file. Negative numbers indicate
de7ddf
# that no size limit is imposed. If positive, it must be >= 8192 to match or
de7ddf
# exceed conmon's read buffer. The file is truncated and re-opened so the
de7ddf
# limit is never exceeded.
de7ddf
#
de7ddf
#log_size_max = -1
de7ddf
de7ddf
# Specifies default format tag for container log messages.
de7ddf
# This is useful for creating a specific tag for container log messages.
de7ddf
# Containers logs default to truncated container ID as a tag.
de7ddf
#
de7ddf
#log_tag = ""
de7ddf
de7ddf
# Default way to to create a Network namespace for the container
de7ddf
# Options are:
de7ddf
# `private` Create private Network Namespace for the container.
de7ddf
# `host`    Share host Network Namespace with the container.
de7ddf
# `none`    Containers do not use the network
de7ddf
#
de7ddf
#netns = "private"
de7ddf
de7ddf
# Create /etc/hosts for the container.  By default, container engine manage
de7ddf
# /etc/hosts, automatically adding  the container's  own  IP  address.
de7ddf
#
de7ddf
#no_hosts = false
de7ddf
de7ddf
# Default way to to create a PID namespace for the container
de7ddf
# Options are:
de7ddf
# `private` Create private PID Namespace for the container.
de7ddf
# `host`    Share host PID Namespace with the container.
de7ddf
#
de7ddf
#pidns = "private"
de7ddf
de7ddf
# Maximum number of processes allowed in a container.
de7ddf
#
de7ddf
#pids_limit = 2048
de7ddf
de7ddf
# Copy the content from the underlying image into the newly created volume
de7ddf
# when the container is created instead of when it is started. If false,
de7ddf
# the container engine will not copy the content until the container is started.
de7ddf
# Setting it to true may have negative performance implications.
de7ddf
#
de7ddf
#prepare_volume_on_create = false
de7ddf
de7ddf
# Indicates the networking to be used for rootless containers
de7ddf
#
de7ddf
#rootless_networking = "slirp4netns"
de7ddf
de7ddf
# Path to the seccomp.json profile which is used as the default seccomp profile
de7ddf
# for the runtime.
de7ddf
#
de7ddf
#seccomp_profile = "/usr/share/containers/seccomp.json"
de7ddf
de7ddf
# Size of /dev/shm. Specified as <number><unit>.
de7ddf
# Unit is optional, values:
de7ddf
# b (bytes), k (kilobytes), m (megabytes), or g (gigabytes).
de7ddf
# If the unit is omitted, the system uses bytes.
de7ddf
#
de7ddf
#shm_size = "65536k"
de7ddf
de7ddf
# Set timezone in container. Takes IANA timezones as well as "local",
de7ddf
# which sets the timezone in the container to match the host machine.
de7ddf
#
de7ddf
#tz = ""
de7ddf
de7ddf
# Set umask inside the container
de7ddf
#
de7ddf
#umask = "0022"
de7ddf
de7ddf
# Default way to to create a User namespace for the container
de7ddf
# Options are:
de7ddf
# `auto`        Create unique User Namespace for the container.
de7ddf
# `host`    Share host User Namespace with the container.
de7ddf
#
de7ddf
#userns = "host"
de7ddf
de7ddf
# Number of UIDs to allocate for the automatic container creation.
de7ddf
# UIDs are allocated from the "container" UIDs listed in
de7ddf
# /etc/subuid & /etc/subgid
de7ddf
#
de7ddf
#userns_size = 65536
de7ddf
de7ddf
# Default way to to create a UTS namespace for the container
de7ddf
# Options are:
de7ddf
# `private`        Create private UTS Namespace for the container.
de7ddf
# `host`    Share host UTS Namespace with the container.
de7ddf
#
de7ddf
#utsns = "private"
de7ddf
de7ddf
# List of volumes. Specified as
de7ddf
# "<directory-on-host>:<directory-in-container>:<options>", for example:
de7ddf
# "/db:/var/lib/db:ro".
de7ddf
# If it is empty or commented out, no volumes will be added
de7ddf
#
de7ddf
#volumes = []
de7ddf
de7ddf
# The network table contains settings pertaining to the management of
de7ddf
# CNI plugins.
de7ddf
de7ddf
[secrets]
de7ddf
#driver = "file"
de7ddf
de7ddf
[secrets.opts]
de7ddf
#root = "/example/directory"
de7ddf
de7ddf
[network]
de7ddf
de7ddf
# Path to directory where CNI plugin binaries are located.
de7ddf
#
de7ddf
#cni_plugin_dirs = ["/usr/libexec/cni"]
de7ddf
de7ddf
# The network name of the default CNI network to attach pods to.
de7ddf
#
de7ddf
#default_network = "podman"
de7ddf
de7ddf
# The default subnet for the default CNI network given in default_network.
de7ddf
# If a network with that name does not exist, a new network using that name and
de7ddf
# this subnet will be created.
de7ddf
# Must be a valid IPv4 CIDR prefix.
de7ddf
#
de7ddf
#default_subnet = "10.88.0.0/16"
de7ddf
de7ddf
# Path to the directory where CNI configuration files are located.
de7ddf
#
de7ddf
#network_config_dir = "/etc/cni/net.d/"
de7ddf
de7ddf
[engine]
de7ddf
# Index to the active service
de7ddf
#
de7ddf
#active_service = production
de7ddf
de7ddf
# Cgroup management implementation used for the runtime.
de7ddf
# Valid options "systemd" or "cgroupfs"
de7ddf
#
de7ddf
#cgroup_manager = "systemd"
de7ddf
de7ddf
# Environment variables to pass into conmon
de7ddf
#
de7ddf
#conmon_env_vars = [
de7ddf
#  "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
de7ddf
#]
de7ddf
de7ddf
# Paths to look for the conmon container manager binary
de7ddf
#
de7ddf
#conmon_path = [
de7ddf
#  "/usr/libexec/podman/conmon",
de7ddf
#  "/usr/local/libexec/podman/conmon",
de7ddf
#  "/usr/local/lib/podman/conmon",
de7ddf
#  "/usr/bin/conmon",
de7ddf
#  "/usr/sbin/conmon",
de7ddf
#  "/usr/local/bin/conmon",
de7ddf
#  "/usr/local/sbin/conmon"
de7ddf
#]
de7ddf
de7ddf
# Specify the keys sequence used to detach a container.
de7ddf
# Format is a single character [a-Z] or a comma separated sequence of
de7ddf
# `ctrl-<value>`, where `<value>` is one of:
de7ddf
# `a-z`, `@`, `^`, `[`, `\`, `]`, `^` or `_`
de7ddf
#
de7ddf
#detach_keys = "ctrl-p,ctrl-q"
de7ddf
de7ddf
# Determines whether engine will reserve ports on the host when they are
de7ddf
# forwarded to containers. When enabled, when ports are forwarded to containers,
de7ddf
# ports are held open by as long as the container is running, ensuring that
de7ddf
# they cannot be reused by other programs on the host. However, this can cause
de7ddf
# significant memory usage if a container has many ports forwarded to it.
de7ddf
# Disabling this can save memory.
de7ddf
#
de7ddf
#enable_port_reservation = true
de7ddf
de7ddf
# Environment variables to be used when running the container engine (e.g., Podman, Buildah).
de7ddf
# For example "http_proxy=internal.proxy.company.com".
de7ddf
# Note these environment variables will not be used within the container.
de7ddf
# Set the env section under [containers] table, if you want to set environment variables for the container.
de7ddf
#
de7ddf
#env = []
de7ddf
de7ddf
# Selects which logging mechanism to use for container engine events.
de7ddf
# Valid values are `journald`, `file` and `none`.
de7ddf
#
de7ddf
#events_logger = "journald"
de7ddf
events_logger = "file"
de7ddf
de7ddf
# Path to OCI hooks directories for automatically executed hooks.
de7ddf
#
de7ddf
#hooks_dir = [
de7ddf
#  "/usr/share/containers/oci/hooks.d",
de7ddf
#]
de7ddf
de7ddf
# Manifest Type (oci, v2s2, or v2s1) to use when pulling, pushing, building
de7ddf
# container images. By default image pulled and pushed match the format of the
de7ddf
# source image. Building/committing defaults to OCI.
de7ddf
#
de7ddf
#image_default_format = ""
de7ddf
de7ddf
# Default transport method for pulling and pushing for images
de7ddf
#
de7ddf
#image_default_transport = "docker://"
de7ddf
de7ddf
# Maximum number of image layers to be copied (pulled/pushed) simultaneously.
de7ddf
# Not setting this field, or setting it to zero, will fall back to containers/image defaults.
de7ddf
#
de7ddf
#image_parallel_copies = 0
de7ddf
de7ddf
# Default command to run the infra container
de7ddf
#
de7ddf
#infra_command = "/pause"
de7ddf
de7ddf
# Infra (pause) container image name for pod infra containers.  When running a
de7ddf
# pod, we start a `pause` process in a container to hold open the namespaces
de7ddf
# associated with the  pod.  This container does nothing other then sleep,
de7ddf
# reserving the pods resources for the lifetime of the pod.
de7ddf
#
de7ddf
#infra_image = "k8s.gcr.io/pause:3.4.1"
de7ddf
infra_image = "registry.access.redhat.com/ubi8/pause"
de7ddf
de7ddf
# Specify the locking mechanism to use; valid values are "shm" and "file".
de7ddf
# Change the default only if you are sure of what you are doing, in general
de7ddf
# "file" is useful only on platforms where cgo is not available for using the
de7ddf
# faster "shm" lock type.  You may need to run "podman system renumber" after
de7ddf
# you change the lock type.
de7ddf
#
de7ddf
#lock_type** = "shm"
de7ddf
de7ddf
# Indicates if Podman is running inside a VM via Podman Machine.
de7ddf
# Podman uses this value to do extra setup around networking from the
de7ddf
# container inside the VM to to host.
de7ddf
#
de7ddf
#machine_enabled = false
de7ddf
de7ddf
# MultiImageArchive - if true, the container engine allows for storing archives
de7ddf
# (e.g., of the docker-archive transport) with multiple images.  By default,
de7ddf
# Podman creates single-image archives.
de7ddf
#
de7ddf
#multi_image_archive = "false"
de7ddf
de7ddf
# Default engine namespace
de7ddf
# If engine is joined to a namespace, it will see only containers and pods
de7ddf
# that were created in the same namespace, and will create new containers and
de7ddf
# pods in that namespace.
de7ddf
# The default namespace is "", which corresponds to no namespace. When no
de7ddf
# namespace is set, all containers and pods are visible.
de7ddf
#
de7ddf
#namespace = ""
de7ddf
de7ddf
# Path to the slirp4netns binary
de7ddf
#
de7ddf
#network_cmd_path = ""
de7ddf
de7ddf
# Default options to pass to the slirp4netns binary.
de7ddf
# For example "allow_host_loopback=true"
de7ddf
#
de7ddf
#network_cmd_options = []
de7ddf
de7ddf
# Whether to use chroot instead of pivot_root in the runtime
de7ddf
#
de7ddf
#no_pivot_root = false
de7ddf
de7ddf
# Number of locks available for containers and pods.
de7ddf
# If this is changed, a lock renumber must be performed (e.g. with the
de7ddf
# 'podman system renumber' command).
de7ddf
#
de7ddf
#num_locks = 2048
de7ddf
de7ddf
# Whether to pull new image before running a container
de7ddf
#
de7ddf
#pull_policy = "missing"
de7ddf
de7ddf
# Indicates whether the application should be running in remote mode. This flag modifies the
de7ddf
# --remote option on container engines. Setting the flag to true will default
de7ddf
# `podman --remote=true` for access to the remote Podman service.
de7ddf
#
de7ddf
#remote = false
de7ddf
de7ddf
# Default OCI runtime
de7ddf
#
de7ddf
#runtime = "crun"
de7ddf
runtime = "crun"
de7ddf
de7ddf
# List of the OCI runtimes that support --format=json.  When json is supported
de7ddf
# engine will use it for reporting nicer errors.
de7ddf
#
de7ddf
#runtime_supports_json = ["crun", "runc", "kata", "runsc"]
de7ddf
de7ddf
# List of the OCI runtimes that supports running containers with KVM Separation.
de7ddf
#
de7ddf
#runtime_supports_kvm = ["kata"]
de7ddf
de7ddf
# List of the OCI runtimes that supports running containers without cgroups.
de7ddf
#
de7ddf
#runtime_supports_nocgroups = ["crun"]
de7ddf
de7ddf
# Directory for persistent engine files (database, etc)
de7ddf
# By default, this will be configured relative to where the containers/storage
de7ddf
# stores containers
de7ddf
# Uncomment to change location from this default
de7ddf
#
de7ddf
#static_dir = "/var/lib/containers/storage/libpod"
de7ddf
de7ddf
# Number of seconds to wait for container to exit before sending kill signal.
de7ddf
#
de7ddf
#stop_timeout = 10
de7ddf
de7ddf
# map of service destinations
de7ddf
#
de7ddf
#[service_destinations]
de7ddf
#  [service_destinations.production]
de7ddf
#     URI to access the Podman service
de7ddf
#     Examples:
de7ddf
#       rootless "unix://run/user/$UID/podman/podman.sock" (Default)
de7ddf
#       rootfull "unix://run/podman/podman.sock (Default)
de7ddf
#       remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock
de7ddf
#       remote rootfull ssh://root@10.10.1.136:22/run/podman/podman.sock
de7ddf
#
de7ddf
#    uri = "ssh://user@production.example.com/run/user/1001/podman/podman.sock"
de7ddf
#    Path to file containing ssh identity key
de7ddf
#    identity = "~/.ssh/id_rsa"
de7ddf
de7ddf
# Directory for temporary files. Must be tmpfs (wiped after reboot)
de7ddf
#
de7ddf
#tmp_dir = "/run/libpod"
de7ddf
de7ddf
# Directory for libpod named volumes.
de7ddf
# By default, this will be configured relative to where containers/storage
de7ddf
# stores containers.
de7ddf
# Uncomment to change location from this default.
de7ddf
#
de7ddf
#volume_path = "/var/lib/containers/storage/volumes"
de7ddf
de7ddf
# Paths to look for a valid OCI runtime (crun, runc, kata, runsc, etc)
de7ddf
[engine.runtimes]
de7ddf
#crun = [
de7ddf
#  "/usr/bin/crun",
de7ddf
#  "/usr/sbin/crun",
de7ddf
#  "/usr/local/bin/crun",
de7ddf
#  "/usr/local/sbin/crun",
de7ddf
#  "/sbin/crun",
de7ddf
#  "/bin/crun",
de7ddf
#  "/run/current-system/sw/bin/crun",
de7ddf
#]
de7ddf
de7ddf
#kata = [
de7ddf
#  "/usr/bin/kata-runtime",
de7ddf
#  "/usr/sbin/kata-runtime",
de7ddf
#  "/usr/local/bin/kata-runtime",
de7ddf
#  "/usr/local/sbin/kata-runtime",
de7ddf
#  "/sbin/kata-runtime",
de7ddf
#  "/bin/kata-runtime",
de7ddf
#  "/usr/bin/kata-qemu",
de7ddf
#  "/usr/bin/kata-fc",
de7ddf
#]
de7ddf
de7ddf
#runc = [
de7ddf
#  "/usr/bin/runc",
de7ddf
#  "/usr/sbin/runc",
de7ddf
#  "/usr/local/bin/runc",
de7ddf
#  "/usr/local/sbin/runc",
de7ddf
#  "/sbin/runc",
de7ddf
#  "/bin/runc",
de7ddf
#  "/usr/lib/cri-o-runc/sbin/runc",
de7ddf
#]
de7ddf
de7ddf
#runsc = [
de7ddf
#  "/usr/bin/runsc",
de7ddf
#  "/usr/sbin/runsc",
de7ddf
#  "/usr/local/bin/runsc",
de7ddf
#  "/usr/local/sbin/runsc",
de7ddf
#  "/bin/runsc",
de7ddf
#  "/sbin/runsc",
de7ddf
#  "/run/current-system/sw/bin/runsc",
de7ddf
#]
de7ddf
de7ddf
[engine.volume_plugins]
de7ddf
#testplugin = "/run/podman/plugins/test.sock"
de7ddf
de7ddf
# The [engine.volume_plugins] table MUST be the last entry in this file.
de7ddf
# (Unless another table is added)
de7ddf
# TOML does not provide a way to end a table other than a further table being
de7ddf
# defined, so every key hereafter will be part of [volume_plugins] and not the
de7ddf
# main config.