allow a container to run in a new cgroup namespace.
When running in a new cgroup namespace, the current cgroup appears to
be the root, so that there is no way for the container to access
cgroups outside of its own subtree.
By default it uses --cgroup=host to keep the previous behavior.
To create a new namespace, --cgroup=private must be provided.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
podman - Simple debugging tool for pods and images
podman is a daemonless container runtime for managing containers, pods, and container images.
It is intended as a counterpart to CRI-O, to provide low-level debugging not available through the CRI interface used by Kubernetes.
It can also act as a container runtime independent of CRI-O, creating and managing its own set of containers.
Use cases
Create containers
Start, stop, signal, attach to, and inspect existing containers
Run new commands in existing containers
Push and pull images
List and inspect existing images
Create new images by committing changes within a container
0b57e77d7c