opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 11:32:07 +08:00
Code Issues Packages Projects Releases Wiki Activity

Add quadlet container support for Mask,Umask options

Browse Source 
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2023-06-14 14:07:34 -04:00
parent 7c76907e50
commit bdc2e81654
5 changed files with 50 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
docs/source/markdown/podman-systemd.unit.5.md
View File

@ -541,6 +541,10 @@ The current default value is `none`.
Set the log-driver Podman uses when running the container.
Equivalent to the Podman `--log-driver` option.
### `Mask=`
Specify the paths to mask separated by a colon. `Mask=/path/1:/path/2`. A masked path cannot be accessed inside the container.
### `Network=`
Specify a custom network for the container. This has the same format as the `--network` option
@ -584,6 +588,16 @@ entry from the unit file takes precedence
This key can be listed multiple times.
### `Unmask=`
Specify the paths to unmask separated by a colon. unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*):
If set to `ALL`, Podman will unmask all the paths that are masked or made read-only by default.
The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux.
The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup.
### `UserNS=`
Set the user namespace mode for the container. This is equivalent to the Podman `--userns` option and