Docs rootfull -> rootful
Some docs say roofull. Change to rootful. [NO NEW TESTS NEEDED] Signed-off-by: Ashley Cui <acui@redhat.com>
This commit is contained in:
parent
1260bf631f
commit
a615cb2fe2
|
@ -685,7 +685,7 @@ suitable group name to use as the default setting for this option.
|
|||
|
||||
**NOTE:** When this option is specified by a rootless user, the specified
|
||||
mappings are relative to the rootless user namespace in the container, rather
|
||||
than being relative to the host as it would be when run rootfull.
|
||||
than being relative to the host as it would be when run rootful.
|
||||
|
||||
#### **--userns-uid-map**=*mapping*
|
||||
|
||||
|
@ -721,7 +721,7 @@ suitable user name to use as the default setting for this option.
|
|||
|
||||
**NOTE:** When this option is specified by a rootless user, the specified
|
||||
mappings are relative to the rootless user namespace in the container, rather
|
||||
than being relative to the host as it would be when run rootfull.
|
||||
than being relative to the host as it would be when run rootful.
|
||||
|
||||
#### **--uts**=*how*
|
||||
|
||||
|
|
|
@ -704,7 +704,7 @@ Set the network mode for the container. Invalid if using **--dns**, **--dns-opt*
|
|||
|
||||
Valid _mode_ values are:
|
||||
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootfull containers. It is possible to specify these additional options:
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options:
|
||||
- **alias=name**: Add network-scoped alias for the container.
|
||||
- **ip=IPv4**: Specify a static ipv4 address for this container.
|
||||
- **ip=IPv6**: Specify a static ipv6 address for this container.
|
||||
|
@ -717,7 +717,7 @@ Valid _mode_ values are:
|
|||
- **container:**_id_: Reuse another container's network stack.
|
||||
- **host**: Do not create a network namespace, the container will use the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
|
||||
- **ns:**_path_: Path to a network namespace to join.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootfull containers and **slirp4netns** for rootless ones.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones.
|
||||
- **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf:
|
||||
- **allow_host_loopback=true|false**: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). Default is false.
|
||||
- **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`).
|
||||
|
@ -1118,8 +1118,8 @@ option conflicts with the **--userns** and **--subuidname** options. This
|
|||
option provides a way to map host UIDs to container UIDs. It can be passed
|
||||
several times to map different ranges.
|
||||
|
||||
The _from_uid_ value is based upon the user running the command, either rootfull or rootless users.
|
||||
* rootfull user: *container_uid*:*host_uid*:*amount*
|
||||
The _from_uid_ value is based upon the user running the command, either rootful or rootless users.
|
||||
* rootful user: *container_uid*:*host_uid*:*amount*
|
||||
* rootless user: *container_uid*:*intermediate_uid*:*amount*
|
||||
|
||||
When **podman create** is called by a privileged user, the option **--uidmap**
|
||||
|
|
|
@ -9,7 +9,7 @@ podman\-network\-reload - Reload network configuration for containers
|
|||
## DESCRIPTION
|
||||
Reload one or more container network configurations.
|
||||
|
||||
Rootfull Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted,
|
||||
Rootful Podman relies on iptables rules in order to provide network connectivity. If the iptables rules are deleted,
|
||||
this happens for example with `firewall-cmd --reload`, the container loses network connectivity. This command restores
|
||||
the network connectivity.
|
||||
|
||||
|
|
|
@ -188,7 +188,7 @@ Note: When joining multiple networks you should use the **--network name:mac=\<m
|
|||
Change the network mode of the pod. The host network mode should be configured in the YAML file.
|
||||
Valid _mode_ values are:
|
||||
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootfull containers. It is possible to specify these additional options:
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options:
|
||||
- **alias=name**: Add network-scoped alias for the container.
|
||||
- **ip=IPv4**: Specify a static ipv4 address for this container.
|
||||
- **ip=IPv6**: Specify a static ipv6 address for this container.
|
||||
|
@ -200,7 +200,7 @@ Valid _mode_ values are:
|
|||
- **none**: Create a network namespace for the container but do not configure network interfaces for it, thus the container has no network connectivity.
|
||||
- **container:**_id_: Reuse another container's network stack.
|
||||
- **ns:**_path_: Path to a network namespace to join.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootfull containers and **slirp4netns** for rootless ones.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones.
|
||||
- **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf:
|
||||
- **allow_host_loopback=true|false**: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). Default is false.
|
||||
- **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`).
|
||||
|
|
|
@ -156,7 +156,7 @@ Set the network mode for the pod. Invalid if using **--dns**, **--dns-opt**, or
|
|||
|
||||
Valid _mode_ values are:
|
||||
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootfull containers. It is possible to specify these additional options:
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options:
|
||||
- **alias=name**: Add network-scoped alias for the container.
|
||||
- **ip=IPv4**: Specify a static ipv4 address for this container.
|
||||
- **ip=IPv6**: Specify a static ipv6 address for this container.
|
||||
|
@ -169,7 +169,7 @@ Valid _mode_ values are:
|
|||
- **container:**_id_: Reuse another container's network stack.
|
||||
- **host**: Do not create a network namespace, the container will use the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
|
||||
- **ns:**_path_: Path to a network namespace to join.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootfull containers and **slirp4netns** for rootless ones.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones.
|
||||
- **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf:
|
||||
- **allow_host_loopback=true|false**: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). Default is false.
|
||||
- **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`).
|
||||
|
|
|
@ -117,7 +117,7 @@ Using short names is subject to the risk of hitting squatted registry namespaces
|
|||
While it is highly recommended to always use fully-qualified image references, existing deployments using short names may not be easily changed. To circumvent the aforementioned ambiguity, so called short-name aliases can be configured that point to a fully-qualified image reference. Distributions often ship a default shortnames.conf expansion file in /etc/containers/registries.conf.d/ directory. Administrators can use this directory to add their own local short-name expansion files.
|
||||
|
||||
When pulling an image, if the user does not specify the complete registry, container engines attempt to expand the short-name into a full name. If the command is executed with a tty, the user will be prompted to select a registry from the
|
||||
default list unqualified registries defined in registries.conf. The user's selection is then stored in a cache file to be used in all future short-name expansions. Rootfull short-names are stored in /var/cache/containers/short-name-aliases.conf. Rootless short-names are stored in the $HOME/.cache/containers/short-name-aliases.conf file.
|
||||
default list unqualified registries defined in registries.conf. The user's selection is then stored in a cache file to be used in all future short-name expansions. Rootful short-names are stored in /var/cache/containers/short-name-aliases.conf. Rootless short-names are stored in the $HOME/.cache/containers/short-name-aliases.conf file.
|
||||
|
||||
For more information on short-names, see `containers-registries.conf(5)`
|
||||
|
||||
|
|
|
@ -730,7 +730,7 @@ Set the network mode for the container. Invalid if using **--dns**, **--dns-opt*
|
|||
|
||||
Valid _mode_ values are:
|
||||
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootfull containers. It is possible to specify these additional options:
|
||||
- **bridge[:OPTIONS,...]**: Create a network stack on the default bridge. This is the default for rootful containers. It is possible to specify these additional options:
|
||||
- **alias=name**: Add network-scoped alias for the container.
|
||||
- **ip=IPv4**: Specify a static ipv4 address for this container.
|
||||
- **ip=IPv6**: Specify a static ipv6 address for this container.
|
||||
|
@ -743,7 +743,7 @@ Valid _mode_ values are:
|
|||
- **container:**_id_: Reuse another container's network stack.
|
||||
- **host**: Do not create a network namespace, the container will use the host's network. Note: The host mode gives the container full access to local system services such as D-bus and is therefore considered insecure.
|
||||
- **ns:**_path_: Path to a network namespace to join.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootfull containers and **slirp4netns** for rootless ones.
|
||||
- **private**: Create a new namespace for the container. This will use the **bridge** mode for rootful containers and **slirp4netns** for rootless ones.
|
||||
- **slirp4netns[:OPTIONS,...]**: use **slirp4netns**(1) to create a user network stack. This is the default for rootless containers. It is possible to specify these additional options, they can also be set with `network_cmd_options` in containers.conf:
|
||||
- **allow_host_loopback=true|false**: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`). Default is false.
|
||||
- **mtu=MTU**: Specify the MTU to use for this network. (Default is `65520`).
|
||||
|
@ -1185,8 +1185,8 @@ option conflicts with the **--userns** and **--subuidname** options. This
|
|||
option provides a way to map host UIDs to container UIDs. It can be passed
|
||||
several times to map different ranges.
|
||||
|
||||
The _from_uid_ value is based upon the user running the command, either rootfull or rootless users.
|
||||
* rootfull user: *container_uid*:*host_uid*:*amount*
|
||||
The _from_uid_ value is based upon the user running the command, either rootful or rootless users.
|
||||
* rootful user: *container_uid*:*host_uid*:*amount*
|
||||
* rootless user: *container_uid*:*intermediate_uid*:*amount*
|
||||
|
||||
When **podman run** is called by a privileged user, the option **--uidmap**
|
||||
|
|
|
@ -9,7 +9,7 @@ podman\-system\-service - Run an API service
|
|||
## DESCRIPTION
|
||||
The **podman system service** command creates a listening service that will answer API calls for Podman. You may
|
||||
optionally provide an endpoint for the API in URI form. For example, *unix:///tmp/foobar.sock* or *tcp:localhost:8080*.
|
||||
If no endpoint is provided, defaults will be used. The default endpoint for a rootfull
|
||||
If no endpoint is provided, defaults will be used. The default endpoint for a rootful
|
||||
service is *unix:///run/podman/podman.sock* and rootless is *unix://$XDG_RUNTIME_DIR/podman/podman.sock* (for
|
||||
example *unix:///run/user/1000/podman/podman.sock*)
|
||||
|
||||
|
|
|
@ -7,15 +7,15 @@
|
|||
It seems once people master the basics of containers, networking is one of the first
|
||||
aspects they begin experimenting with. And regarding networking, it takes very
|
||||
little experimentation before ending up on the deep end of the pool. The following
|
||||
guide shows the most common network setups for Podman rootfull and rootless containers.
|
||||
guide shows the most common network setups for Podman rootful and rootless containers.
|
||||
Each setup is supported with an example.
|
||||
|
||||
|
||||
## Differences between rootfull and rootless container networking
|
||||
## Differences between rootful and rootless container networking
|
||||
|
||||
One of the guiding factors on networking for containers with Podman is going to be
|
||||
whether or not the container is run by a root user or not. This is because unprivileged
|
||||
users cannot create networking interfaces on the host. Therefore, with rootfull
|
||||
users cannot create networking interfaces on the host. Therefore, with rootful
|
||||
containers, the default networking mode is to use netavark.
|
||||
For rootless, the default network
|
||||
mode is slirp4netns. Because of the limited privileges, slirp4netns lacks some of
|
||||
|
@ -32,13 +32,13 @@ ports being opened automatically due to running a container with a port mapping
|
|||
example). If container traffic does not seem to work properly, check the firewall
|
||||
and allow traffic on ports the container is using. A common problem is that
|
||||
reloading the firewall deletes the cni iptables rules resulting in a loss of
|
||||
network connectivity for rootfull containers. Podman v3 provides the podman
|
||||
network connectivity for rootful containers. Podman v3 provides the podman
|
||||
network reload command to restore this without having to restart the container.
|
||||
|
||||
## Basic Network Setups
|
||||
|
||||
Most containers and pods being run with Podman adhere to a couple of simple scenarios.
|
||||
By default, rootfull Podman will create a bridged network. This is the most straightforward
|
||||
By default, rootful Podman will create a bridged network. This is the most straightforward
|
||||
and preferred network setup for Podman. Bridge networking creates an interface for
|
||||
the container on an internal bridge network, which is then connected to the internet
|
||||
via Network Address Translation(NAT). We also see users wanting to use `macvlan`
|
||||
|
@ -79,7 +79,7 @@ command. Containers can be joined to a network when they are created with the
|
|||
|
||||
As mentioned earlier, slirp4netns is the default network configuration for rootless
|
||||
users. But as of Podman version 4.0, rootless users can also use netavark.
|
||||
The user experience of rootless netavark is very akin to a rootfull netavark, except that
|
||||
The user experience of rootless netavark is very akin to a rootful netavark, except that
|
||||
there is no default network configuration provided. You simply need to create a
|
||||
network, and the one will be created as a bridge network. If you would like to switch from
|
||||
CNI networking to netvaark, you must issue the `podman system reset --force` command.
|
||||
|
@ -95,17 +95,17 @@ will be executed inside an extra network namespace. To join this namespace, use
|
|||
|
||||
#### Example
|
||||
|
||||
By default, rootfull containers use the netavark for its default network if
|
||||
By default, rootful containers use the netavark for its default network if
|
||||
you have not migrated from Podman v3.
|
||||
In this case, no network name must be passed to Podman. However, you can create
|
||||
additional bridged networks with the podman create command.
|
||||
|
||||
The following example shows how to set up a web server and expose it to the network
|
||||
outside the host as both rootfull and rootless. It will also show how an outside
|
||||
outside the host as both rootful and rootless. It will also show how an outside
|
||||
client can connect to the container.
|
||||
|
||||
```
|
||||
(rootfull) $ sudo podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner
|
||||
(rootful) $ sudo podman run -dt --name webserver -p 8080:80 quay.io/libpod/banner
|
||||
00f3440c7576aae2d5b193c40513c29c7964e96bf797cf0cc352c2b68ccbe66a
|
||||
```
|
||||
|
||||
|
@ -120,7 +120,7 @@ how the host and container ports can be mapped for external access. The port co
|
|||
very well have been 80 as well (except for rootless users).
|
||||
|
||||
To connect from an outside client to the webserver, simply point an HTTP client to
|
||||
the host’s IP address at port 8080 for rootfull and port 8081 for rootless.
|
||||
the host’s IP address at port 8080 for rootful and port 8081 for rootless.
|
||||
```
|
||||
(outside_host): $ curl 192.168.99.109:8080
|
||||
___ __
|
||||
|
|
|
@ -83,7 +83,7 @@ load helpers
|
|||
}
|
||||
|
||||
# Issue #5466 - port-forwarding doesn't work with this option and -d
|
||||
@test "podman networking: port with --userns=keep-id for rootless or --uidmap=* for rootfull" {
|
||||
@test "podman networking: port with --userns=keep-id for rootless or --uidmap=* for rootful" {
|
||||
for cidr in "" "$(random_rfc1918_subnet).0/24"; do
|
||||
myport=$(random_free_port 52000-52999)
|
||||
if [[ -z $cidr ]]; then
|
||||
|
|
|
@ -423,7 +423,7 @@ function skip_if_rootless() {
|
|||
######################
|
||||
function skip_if_not_rootless() {
|
||||
if ! is_rootless; then
|
||||
local msg=$(_add_label_if_missing "$1" "rootfull")
|
||||
local msg=$(_add_label_if_missing "$1" "rootful")
|
||||
skip "${msg:-not applicable under rootlfull podman}"
|
||||
fi
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue