Podman: download ældre versioner

Security
- This release addresses CVE-2026-44517, where building a Dockerfile using a ADD or COPY instruction accessing a malicious Git repository or tar archive could cause files outside the build context directory to be included in the build context or copied into the build. Please see GHSA-49p4-px3h-rq49 for more details.
Misc
- Updated Buildah to v1.43.2
- Updated gvisor-tap-vsock to v0.8.9

Security
- This release addresses CVE-2026-33414, where the podman machine init --image command when run on Windows using the Hyper-V backend can run Powershell-escaped commands from the user-specified image path on in a Powershell session on the host (GHSA-hc8w-h2mf-hp59).
Bugfixes
- Fixed a bug where containers with the unless-stopped restart policy would not restart after a reboot when podman-restart.service was enabled (#28152).
- Fixed a bug where setting Entrypoint="" in a Quadlet .container file did not clear the container's entrypoint (#28213).
- Fixed a bug where setting a HealthCmd in a Quadlet .container file to a command that included double-quotes (") would result in a nonfunctional healthcheck due to a parsing issue (#28409).
- Fixed a bug where FreeBSD systems could panic when inspecting containers created with the host network mode (#28289).
API
- Fixed a bug where the Libpod System Check endpoint could perform operations with bad data after returning a 400 error (#28350).
- Fixed a bug where the remote attach API for containers (Libpod & Compat) could panic due to a rare race condition (#28277).
- Fixed a bug where the Secret Create API could not create functional secrets using the shell driver due to options from the default driver being improperly added.
Misc
- Updated Buildah to v1.43.1
- Updated the containers/common library to v0.67.1
- Updated the containers/image library to v5.39.2

Bugfixes
- Fixed a critical bug where automatic migration from BoltDB to SQLite after a reboot could perform a partial migration, with some containers in SQLite and some remaining in BoltDB, when Quadlets were in use (#28215). For those who encountered this bug with 5.8.0 there is no way to automatically recover. If you do not have persistent containers/pods/volumes (i.e. all containers are run using Quadlets) then the easiest option is to move the db.sql file in Podman's storage directory to db.sql.bak (or similar) and reboot again with v5.8.1 to attempt another migration. Please contact the maintainers with any issues during migration and we will assist as able.

Features
- The podman quadlet install command can now install files which contain multiple separate Quadlet files. The files must be separated with a --- delimeter on a new line, and each section must begin with a # FileName=<name> line to name the new Quadlet (#27384).
- Quadlet .container files now support a new key, AppArmor, for configuring the container's AppArmor profile (#27095).
- When running the podman artifact add command against a podman machine VM, if the path being loaded or built is shared into the VM, Podman will load it from the VM's filesystem instead of streaming the data through the REST API, improving performance (#26321).
- The podman update command now features a new option, --ulimit, to update container ulimits (#26381).
- The podman exec command now features a new option, --no-session, which disables tracking of the exec session to improve performance and startup time (#26588).
Changes
- Podman will now automatically attempt to migrate legacy BoltDB databases to SQLite when the system reboots. This is necessary as support for BoltDB will be removed in Podman 6.0 in May. If automatic migration is not possible, a new option, podman system migrate --migrate-db, will manually force a migration.
- The podman secret create - command no longer requires that the secret be provided through a pipe, and instead allows typing the secret through the terminal (#27879).
Bugfixes
- Fixed a bug where containers created by podman play kube with a healthcheck using the initialDelaySeconds option would run healthchecks before the initial delay had expired (#27678).
- Fixed a bug where healthchecks would sometimes fail to execute due to systemd rate limits.
- Fixed a bug where the podman export command would emit a Mount event instead of an Export event.
- Fixed a bug where the podman kube play command incorrectly handled precedence between environment variables set by both the envFrom and env fields (#27287).
- Fixed a bug where the podman kube play command would panic when parsing Pod YAML missing the image field (#27784).
- Fixed a bug where the podman volume mount command returned empty paths when volumes were handled by a plugin driver (#27858).
- Fixed a bug where containers created with --rootfs instead of from an image would show that they had a healthcheck in the starting state even if no healthcheck was defined (#27651).
- Fixed a bug where the podman build command's --pull=newer option did not function correctly (#22845).
- Fixed a bug where the RequiresMountsFor field in Quadlet .container files incorrectly handled bind-mount paths which contained spaces.
- Fixed a bug where the remote Podman client's podman run --detach-keys option did not accept an empty string (IE, no detach keys) (#27414).
- Fixed a bug where the remove Podman client's podman build --secret ... env=VAR option would incorrectly try to read the environment variable on the server side, instead of from the client (#27494).
- Fixed a bug where the podman artifact push and podman artifact pull commands ignored authentication credentials given by the --authfile option (#27421).
- Fixed a bug where Windows paths were incorrectly handled under some circumstances when using the HyperV machine provider (#27571).
- Fixed a bug where the podman run --pod-id-file option was not properly validated, allowing the creation of containers in pods with improper user namespace configuration (#26848).
API
- Added new APIs for interacting with Quadlets, including GET /libpod/quadlets/{name}/file (print contents of a Quadlet file), GET /libpod/quadlets/{name}/exists (check if the given Quadlet exists), POST /libpod/quadlets (install one or more Quadlets), DELETE /libpod/quadlets (remove one or more Quadlets), and DELETE /libpod/quadlets/{name} (remove a single Quadlet).
- Fixed a bug where the Compat and Libpod Logs endpoints for Containers did not use nanosecond-level precision for reported timestamps (#27961).
- Fixed a bug where the Compat Create endpoint for Co

Bugfixes
- Fixed a bug where adding devices to emulated Linux containers on FreeBSD did not work.
- Fixed a bug where the podman system migrate command could panic under certain circumstances when run rootless.
- Fixed a bug where Podman would sometimes not correctly recreate the rootless user namespace when Conmon and the rootless pause process were unexpectedly killed.
- Fixed a bug where the podman kube play command could leak file descriptors.
Misc
- Updated Buildah to v1.42.2
- Updated containers/common to v0.66.1

Security
- This release addresses CVE-2025-52881, where arbitrary write gadgets and procfs write redirects allowed runc container escape and denial of service.
Features
- The remote Podman client and podman system service API server now support encrypting connections with TLS and mTLS, including client authentication by certificate (#24583).
- The podman system connection add command can now create connections to TCP sockets with TLS and mTLS encryption.
- The podman run and podman create commands now support two new options, --creds and --cert-dir, to manage logging into registries to pull images.
- The podman kube play and podman kube down commands can now accept multiple files as input, creating or removing more than one pod or deployment with the same command (#26274).
- The podman kube play command now supports a new option, --no-pod-prefix, to disable prefixing container names with pod names. Please note that this can cause pods to fail to create if the pod shares a name with a container (#26396).
- The podman machine init command now supports a new option, --tls-verify, to control whether the machine image can be pulled from registries without a trusted TLS certificate, with the default being true (TLS verification on) (#26517).
- When running the podman image load and podman build commands against a podman machine VM, if the path being loaded or built is shared into the VM, Podman will load it from the VM's filesystem instead of streaming the data through the REST API, improving performance (#26321).
- A default location for container log files when using the k8s-file log driver can now be specified with the log_path option in containers.conf.
- Default flags for the OCI runtime can now be set with the runtimes_flags option in containers.conf.
- The podman artifact remove command can now accept multiple arguments, for example, podman artifact rm artifact1 artifact2.
- The podman wait command now supports a new option, --return-on-first, which causes podman wait to return after any container matches the condition, as opposed to waiting for all containers to match (#26691).
- The podman container restore command now supports a new option, --tcp-close, allowing containers with active TCP connections to be restored multiple times.
- Quadlet now features support for a new file type, .artifact, allowing OCI artifacts to be managed with Quadlet (#25778).
- Quadlet .container files now support a new key, HttpProxy, to disable the automatic forwarding of HTTP proxy options from the host into the container (#26925).
- Quadlet .pod files now support a new key, StopTimeout, to configure the stop timeout for the pod (#27120).
- Quadlet .build files now support two new keys, BuildArg and IgnoreFile, to specify build arguments and an ignore file (#27065 and #27268).
- Quadlet .kube files now support multiple YAML files in a single .kube file.
- Quadlet now supports templated dependencies for volumes and networks (#25136).
- The podman quadlet install command now supports a new option, --replace, which will replace any existing Quadlet with a conflicting name (#26930).
- The podman quadlet print command now has a new alias, podman quadlet cat (#27296).
- The remote Podman client's podman artifact remove command now supports the --all option.
- The podman artifact add command now supports a new option, --replace, which will replace any existing artifact with the given name (#27082).
- The podman artifact rm command now supports a new option, --ignore, which will suppress errors when attempting to remove an artifact that does not exist (#27084).
- The podman artifact list command now includes artifact creation time in its output (#27314).
- The podman artifact list --format option now supports two new format keys, VirtualSize, returning the size of the artifact in integer bytes, and CreatedAt, returning the time the artifact was created as an RFC3339 timestamp (the existing Size and Created fields returned human-readable information) (#

Bugfixes
- Fixed a bug where stopping the podman machine start command with SIGPIPE could result in machine state being stuck as "Starting" (#26949).
- Fixed a bug where podman build would fail with a permissions error when building Containerfiles using a non-root user and cache mounts (#27044).
Misc
- Updated Buildah to v1.41.5

Security
- This release addresses CVE-2025-9566, where Kubernetes YAML run by podman play kube containing ConfigMap and Secret volumes can use crafted symlinks to overwrite content on the host.
Bugfixes
- Fixed a bug where network creation and removal events were displayed incorrectly when the journald events driver was in use.
- Fixed a bug where the --security-opt seccomp=unconfined option was broken on Windows (#26855).
- Fixed a bug where containers created with a name longer than 64 characters, no explicit hostname, the the container_name_as_hostname option in containers.conf set to true would fail to start.
- Fixed a bug where Podman would fail to start containers when runc 1.3.0 or later was used as the OCI runtime (#26938).
Misc
- Adjusted the systemd-tmpfiles script to recursively remove temporary files directories placed in /tmp, ensuring proper operation of Podman after a reboot if /tmp is not a tmpfs.
- Updated Buildah to v1.41.4
- Updated the containers/storage to v1.59.1
- Updated the containers/common library to v0.64.2

Security
- This release addresses CVE-2025-6032, in which the TLS connection used to pull VM images for podman machine was, by default, not validated, allowing connections to servers with invalid certificates by default and potentially allowing a Man in the Middle attack.
Bugfixes
- Fixed a bug where Podman could panic after a reboot on systems with pods containing containers (#26469).

Bugfixes
- Fixed a bug where containers mounting a volume to / could overmount important directories such as /proc causing start and/or runtime failures due to an issue with mount ordering (#26161).
- Fixed a bug where Quadlet .pod units could fail to start due to their storage not being mounted (#26190).
- Fixed a bug where containers joined to a network with DNS enabled would not include the host's search domains in their resolv.conf (#24713).
- Fixed a bug where the --dns-opt option to podman create, podman run, and podman pod create would append options to the container's resolv.conf, instead of replacing them (#22399).
- Fixed a bug where the podman kube play command would add an empty network alias for containers created with no name specified, causing Netavark to emit extraneous warnings.
- Fixed a bug where the podman system df command would panic when one or more containers were created using a root filesystem (the --rootfs option to podman create and podman run) instead of from an image (#26224).
- Fixed a bug where the log_tag field in containers.conf would override the --log-opt tag=value option to podman create and podman run (#26236).
- Fixed a bug where the podman volume rm and podman volume inspect commands would incorrectly handle volume names containing the _ character when the SQLite database backend was in use (#26168).
- Fixed a bug where the Podman remote client on Windows was unable to mount local folders into containers using overlay mounts (-v source:destination:O) (#25988).
API
- Fixed a bug in the Libpod Create API for Containers where rlimits specified with a value of -1 were causing errors, instead of being interpreted as the maximum possible value (#24886).
- Fixed a bug in the Compat Create API for Containers where specifying an entrypoint of [] (an empty array) was ignored, instead of setting an empty entrypoint (#26078).
Misc
- Updated Buildah to v1.40.1
- Updated the containers/common library to v0.63.1

Features
- A new command has been added, podman machine cp, to copy files into a running podman machine VM.
- A new command has been added, podman artifact extract, to copy some or all of the contents of an OCI artifact to a location on disk.
- The --mount option to podman create, podman run, and podman pod create now supports a new mount type, --mount type=artifact, to mount OCI artifacts into containers.
- The podman artifact add command now features two new options, --append (to add new files to an existing artifact) and --file-type (to specify the MIME type of the file added to the artifact) (#25884).
- The podman artifact rm command now features a new option, --all, to remove all artifacts in the local store.
- The --filter option to podman pause, podman ps, podman restart, podman rm, podman start, podman stop, and podman unpause now accepts a new filter, command, which filters on the first element (argv[0]) of the command run in the container.
- The podman exec command now supports a new option, --cidfile, to specify the ID of the container to exec into via a file (#21256).
- The podman kube generate and podman kube play commands now supports a new annotation, io.podman.annotation.pids-limit/$containername, preserving the PID limit for containers across kube generate and kube play (#24418).
- Quadlet .container units now support three new keys, Memory= (set maximum memory for the created container), ReloadCmd (execute a command via systemd ExecReload), and ReloadSignal (kill the container with the given signal via systemd ExecReload) (#22036).
- Quadlet .container, .image, and .build units now support two new keys, Retry (number of times to retry pulling image on failure) and RetryDelay (delay between retries) (#25109).
- Quadlet .pod units now support a new key, HostName=, to set the pod's hostname (#25639).
- Quadlet files now support a new option, UpheldBy, in the Install section, corresponding to the systemd Upholds option.
- The names of Quadlet units specified as systemd dependencies are now automatically translated - e.g. Wants=my.container is now valid.
- Podman now generates events for the creation and removal of secrets (#24030).
- A new global option has been added to Podman, --cdi-spec-dir, to specify additional search paths for CDI specs to the CDI loader (#18292 and #25691).
- The podman build command now supports a new option, --inherit-labels (defaults to true), which controls whether labels are inherited from the base image or base stages.
- The podman update command now supports two new options, --env and --unsetenv, to alter the environment variables of existing containers (#24875).
Breaking Changes
- Due to changes in Docker API types, two small breaking changes have been made in the Go bindings for the REST API. The containers.Commit() function now returns a new struct (types.IDResponse) with identical contents, and the containers.ExecCreate function's handlers.ExecCreateConfig parameter now contains a different embedded struct, potentially requiring changes to how it is assigned to.
Changes
- Podman now requires at least Go 1.23 to build.
- Healthchecks have been refactored to avoid writing to the database as much as possible, greatly improving performance on systems with many simultaneous healthchecks running.
- Healthchecks now have a new status, stopped, which is reported if the container the healthcheck was run on stopped before the check could be completed (#25276).
- Containers in pods are now stopped in order based on their dependencies, with the infra container being stopped last, preventing application containers from losing networking before they are stopped due to the infra container stopping prematurely.
- Due to challenges with handling automatic installation, the Windows installer no longer installs WSLv2 or Hyper-V.
- Quadlet will now print warnings when skipping lines to help identify malformed Quadlet files (#25339).
- Creating podman machine VMs with a host mount over the VM's /tmp

Bugfixes
- Fixed a bug where the podman import command could not import images compressed with algorithms other than gzip (#25593).
- Fixed a bug where the podman cp command could deadlock when copying into a non-empty volume on a container that is not running (#25585).
API
- Fixed a bug where the default values for some fields in the Libpod Create endpoint for Containers did not have sensible defaults for some healthcheck fields, causing unrestricted log growth for containers which did not set these fields (#25473).
Misc
- Updated vendored Buildah to v1.39.4
- Updated the containers/common library to v0.62.3
- Updated the containers/image library to v5.34.3
- Updated the containers/storage library to v1.57.2

Bugfixes
- Fixed a bug where volume quotas were not being applied (#25368).
- Fixed a bug where the --pid-limit=-1 option did not function properly with containers using the runc OCI runtime.
- Fixed a bug where the podman artifact pull command did not respect the --retry-delay option.
- Fixed a bug where Podman would leak a file and directory for every container created.
- Fixed a bug where the podman wait command would sometimes error when waiting for a container set to auto-remove.
- Fixed a bug where Quadlet .kube units would not report an error (and stay running) even when a pod failed to start (#20667).
API
- Fixed a bug where the Compat DF endpoint did not correctly report total size of all images.
Misc
- Updated Buildah to v1.39.2
- Updated the containers/common library to v0.62.1
- Updated the containers/image library to v5.34.1

Features
- A preview of Podman's support for OCI artifacts has been added through the podman artifact suite of commands, including add, inspect, ls, pull, push, and rm. This support is very early and not fully complete, and the command line interface for these tools has not been finalized. We welcome feedback on the new artifact experience through our issue tracker!
- The podman update command now supports a wide variety of options related to healthchecks (including --health-cmd to define a new healthcheck and --no-healthcheck to disable an existing healthcheck), allowing healthchecks to be added to, removed from, and otherwise updated on existing containers. You can find full details on the 15 added options in the manpage.
- The --mount type=volume option for the podman run, podman create, and podman volume create commands now supports a new option, subpath=, to make only a subset of the volume visible in the container (#20661).
- The --userns=keep-id option for the podman run, podman create, and podman pod create commands now supports a new option, --userns=keep-id:size=, to configure the size of the user namespace (#24387).
- The podman kube play command now supports Container Device Interface (CDI) devices (#17833).
- The podman machine init command now supports a new option, --playbook, to run an Ansible playbook in the created VM on first boot for initial configuration.
- Quadlet .pod files now support a new field, ShmSize, to specify the size of the pod's shared SHM (#22915).
- The podman run, podman create, and podman pod create commands now support a new option, --hosts-file, to define the base file used for /etc/hosts in the container.
- The podman run, podman create, and podman pod create commands now support a new option, --no-hostname, which disables the creation of /etc/hostname in the container (#25002).
- The podman network create command now supports a new option for bridge networks, --opt mode=unmanaged, which allows Podman to use an existing network bridge on the system without changes.
- The --network option to podman run, podman create, and podman pod create now accepts a new option for bridge networks, host_interface_name, which specifies a name for the network interface created outside the container.
- The podman manifest rm command now supports a new option, --ignore, to not error when removing manifests that do not exist.
- The podman system prune command now supports a new option, --build, to remove build containers leftover from prematurely terminated builds.
- The podman events command now generates events for the creation and removal of networks (#24032).
Breaking Changes
- Due to a lack of availability of hardware to test on, the Podman maintainers are no longer capable of providing full support for Podman on Intel Macs. Binaries and machine images will still be produced, and pull requests related to MacOS on Intel systems will still be merged, but bugs will be fixed on a best effort basis only. We welcome any potential new maintainers who would be able to assist in restoring full support.
- Quadlet previously incorrectly allowed : as a character to define comments. This was a mistake; developer intent and documentation was that # and ; were to be used as comment characters instead, matching systemd. This has been corrected, and semicolons now define comments instead of colons.
Changes
- Podman now passes container hostnames to Netavark, which will use them for any DHCP requests for the container.
- Partial pulls of zstd:chunked images now only happen for images that have a RootFS.DiffID entry in the image's OCI config JSON, and require the layer contents to match. This resolves issues with image ID ambiguity when partial pulls were enabled.
- Packagers can now set the BUILD_ORIGIN environment variable when building podman from the Makefile. This provides information on who built the Podman binary, and is displayed in podman version and podman info. This will help upstream bug reports, allowing ma

Security
- This release contains Buildah v1.38.1 which addresses CVE-2024-11218
Bugfixes
- Fixed a bug where Quadlet .build files could create an invalid podman command line when Pull= was used (#24599).
- Fixed a bug where the Mac installer did not install the Podman manpages (#24756).
Misc
- Updated Buildah to v1.38.1
- Updated the containers/common library to v0.61.1
- Updated the containers/storage library to v1.56.1
- Updated the containers/image library to v5.33.1

- Fixed a bug where the --ignition-path option to podman machine init would prevent creation of necessary files for the VM, rendering it unusable (#23544).
- Fixed a bug where rootless containers using the bridge networking mode would be unable to start due to a panic caused by a nil pointer dereference (#24566).
- Fixed a bug where Podman containers would try to set increased rlimits when started in a user namespace, rendering containers unable to start (#24508).
- Fixed a bug where certain SSH configurations would make the remote Podman client unable to connect to the server (#24567).
- Fixed a bug where the Windows installer could install WSLv2 when upgrading an existing Podman installation that used the Hyper-V virtualization backend.

Security
- This release addresses CVE-2024-9675, which allows arbitrary access to the host filesystem from RUN --mount type=cache arguments to a Dockerfile being built.
- This release also addresses CVE-2024-9676, which allows malicious images with a symlink /etc/passwd or /etc/group to potentially cause a denial of service through reading a FIFO on the host.
Misc
- Updated Buildah to v1.37.5
- Updated the containers/storage library to v1.55.1

Security
- This release addresses CVE-2024-9407, which allows arbitrary access to the host filesystem from RUN --mount arguments to a Dockerfile being built.
- This release also addresses CVE-2024-9341, allowing the mounting of arbitrary directories from the host into containers on FIPS enabled systems using a malicious image with crafted symlinks.
Misc
- Updated Buildah to v1.37.4
- Updated the containers/common library to v0.60.4

Bugfixes
- Fixed a bug that could cause network namespaces to fail to unmount, resulting in Podman commands hanging.
- Fixed a bug where Podman could not run images which included SCTP exposed ports.
- Fixed a bug where containers run by the root user, but inside a user namespace (including inside a container), could not use the pasta network mode.
- Fixed a bug where volume copy-up did not properly chown empty volumes when the :idmap mount option was used.
Misc
- Updated Buildah to v1.37.3

Bugfixes
- Fixed a bug where rootless Podman could fail to validate the runtime's volume path on systems with a symlinked /home (#23515).
Misc
- Updated Buildah to v1.37.2
- Updated the containers/common library to v0.60.2
- Updated the containers/image library to v5.32.2

Bugfixes
- Fixed a bug where Podman could sometimes save an incorrect container state to the database, which could cause a number of issues including but not limited to attempting to clean up containers twice (#21569).
Misc
- Updated Buildah to v1.37.1
- Updated the containers/common library to v0.60.1
- Updated the containers/image library to v5.32.1

Features
- Podman now supports libkrun as a backend for creating virtual machines on MacOS. The libkrun backend has the advantage of allowing GPUs to be mounted into the virtual machine to accelerate tasks. The default backend remains applehv.
- Quadlet now has support for .build files, which allows images to be built by Quadlet and then used by Quadlet containers.
- Quadlet .container files now support two new fields, LogOpt to specify container logging configuration and StopSignal to specify container stop signal (#23050).
- Quadlet .container and .pod files now support a new field, NetworkAlias, to add network aliases.
- Quadlet drop-in search paths have been expanded to include top-level type drop-ins (container.d, pod.d) and truncated unit drop-ins (unit-.container.d) (#23158).
- Podman now supports a new command, podman system check, which will identify (and, if possible, correct) corruption within local container storage.
- The podman machine reset command will now reset all providers available on the current operating system (e.g. ensuring that both HyperV and WSL podman machine VMs will be removed on Windows).
Changes
- Podman now requires the new kernel mount API, introducing a dependency on Linux Kernel v5.2 or higher.
- Quadlet .image units now have a dependency on network-online.target (#21873).
- The --device option to podman create and podman run is no longer ignored when --privileged is also specified (#23132).
- The podman start and podman stop commands no longer print the full ID of the pod started/stopped, but instead the user's input used to specify the pod (e.g. podman pod start b will print b instead of the pod's full ID) (#22590).
- Virtual machines created by podman machine on Linux now use virtiofs instead of 9p for mounting host filesystems. Existing mounts will be transparently changed on machine restart or recreation. This should improve performance and reliability of host mounts. This requires the installation of virtiofsd on the host system to function.
- Using both the --squash and --layers=false options to podman build at the same time is now allowed.
- Podman now passes container's stop timeout to systemd when creating cgroups, causing it to be honored when systemd stops the scope. This should prevent hangs on system shutdown due to running Podman containers.
- The --volume-driver option to podman machine init is now deprecated.
Bugfixes
- Fixed a bug where rootless containers created with the --sdnotify=healthy option could panic when started (#22651).
- Fixed a bug where containers created with the --sdnotify=healthy option that exited quickly would sometimes return an error instead of notifying that the container was ready (#22760).
- Fixed a bug where the podman system reset command did not remove the containers/image blob cache (#22825).
- Fixed a bug where Podman would sometimes create a cgroup for itself even when the --cgroups=disabled option was specified at container creation time (#20910).
- Fixed a bug where the /etc/hosts file in a container was not created with a newline at the end of the file (#22729).
- Fixed a bug where the podman start command could sometimes panic when starting a container in the stopped state.
- Fixed a bug where the podman system renumber command would fail if volumes existed when using the sqlite database backend (#23052).
- Fixed a bug where the podman container restore command could not successfully restore a container in a pod.
- Fixed a bug where an error message from podman diff would suggest using the --latest option when using the remote Podman client (#23038).
- Fixed a bug where user could assign more memory to a Podman machine than existed on the host (#18206).
- Fixed a bug where the podman events command was rarely unable to report errors that occurred (#23165).
- Fixed a bug where containers run in systemd units would sometimes not be removed correctly on exit when using the --cidfile option.
- Fixed a bug where the first Podman command run af

Bugfixes
- Fixed a bug that would sometimes prevent the mount of some podman machine volumes into the virtual machine when using the Apple hypervisor (#22569).
- Fixed a bug where podman top would show the incorrect UID for processes in containers run in a user namespace (#22293).
- Fixed a bug where the /etc/hosts and /etc/resolv.conf files in a container would be empty after restoring from a checkpoint (#22901).
- Fixed a bug where the --pod-id-file argument to podman run and podman create did not respect the pod's user namespace (#22931).
- Fixed a bug in the Podman remote client where specifying a invalid connection in the CONTAINER_CONNECTION environment variable would lead to a panic.
Misc
- Virtual machines run by podman machine using the Apple hypervisor now wait 90 seconds before forcibly stopping the VM, matching the standard systemd shutdown timeout (#22515).
- Updates the containers/image library to v5.31.1

Bugfixes
- Fixed a bug where systemd timers associated with startup healthchecks would not be properly deleted after transitioning to the regular healthcheck (#22884).
Misc
- Updated the containers/common library to v0.59.1

Features
- VMs created by podman machine on macOS with Apple silicon can now use Rosetta 2 (a.k.a Rosetta) for high-speed emulation of x86 code. This is enabled by default. If you wish to change this option, you can use the CONTAINERS_MACHINE_ROSETTA environment variable or containers.conf.
- Changes made by the podman update command are now persistent, and will survive container restart and be reflected in podman inspect.
- The podman update command now includes a new option, --restart, to update the restart policy of existing containers.
- Quadlet .container files now support a new key, GroupAdd, to add groups to the container.
- Container annotations are now printed by podman inspect.
- Image-based mounts using podman run --mount type=image,... now support a new option, subpath, to mount only part of the image into the container.
- A new field, healthcheck_events, has been added to containers.conf under the [engine] section to allow users to disable the generation of health_status events to avoid spamming logs on systems with many healthchecks.
- A list of images to automatically mount as volumes can now be specified in Kubernetes YAML via the io.podman.annotations.kube.image.automount/$CTRNAME annotation (where $CTRNAME is the name of the container they will be mounted into).
- The podman info command now includes the default rootless network command (pasta or slirp4netns).
- The podman ps command now shows ports from --expose that have not been published with --publish-all to improve Docker compatibility.
- The podman runlabel command now expands $HOME in the label being run to the user's home directory.
- A new alias, podman network list, has been added to the podman network ls command.
- The name and shell of containers created by podmansh can now be set in containers.conf.
- The podman-setup.exe Windows installer now provides 3 new CLI variables, MachineProvider (choose the provider for the machine, windows or wsl, the default), HyperVCheckbox (can be set to 1 to install HyperV if it is not already installed or 0, the default, to not install HyperV), and SkipConfigFileCreation (can be set to 1 to disable the creation of configuration files, or 0, the default).
Changes
- Podman now changes volume ownership every time an empty named volume is mounted into a container, not just the first time, matching Docker's behavior.
- When running Kubernetes YAML with podman kube play that does not include an imagePullPolicy and does not set a tag for the image, the image is now always pulled (#21211).
- When running Kubernetes YAML with podman kube play, pod-level restart policies are now passed down to individual containers within the pod (#20903).
- The --runroot global option can now accept paths with lengths longer than 50 characters (#22272).
- Updating containers with the podman update command now emits an event.
Bugfixes
- Fixed a bug where the --userns=keep-id:uid=0 option to podman create and podman run would generate incorrect UID mappings and cause the container to fail to start (#22078).
- Fixed a bug where podman stats could report inaccurate percentages for very large or very small values (#22064).
- Fixed a bug where bind-mount volumes defaulted to rbind instead of bind, meaning recursive mounts were allowed by default (#22107).
- Fixed a bug where the podman machine rm -f command would fail to remove Hyper-V virtual machines if they were running.
- Fixed a bug where the podman ps --sync command could sometimes fail to properly update the status of containers.
- Fixed a bug where bind-mount volumes using the :idmap option would sometimes be inaccessible with rootless Podman (#22228).
- Fixed a bug where bind-mount volumes using the :U option would have their ownership changed to the owner of the directory in the image being mounted over (#22224).
- Fixed a bug where removing multiple containers, pods, or images with the --force option did not work when multiple arguments were given to the command and one of them did n

Security
- This release addresses CVE-2024-3727, a vulnerability in the containers/image library which allows attackers to trigger authenticated registry access on behalf of the victim user.
Bugfixes
- Fixed a bug where podman machine start would fail if the machine had a volume with a long target path (#22226).
- Fixed a bug where podman machine start mounted volumes with paths that included dashes in the wrong location (#22505).
Misc
- Updated Buildah to v1.35.4
- Updated the containers/common library to v0.58.3
- Updated the containers/image library to v5.30.1

Bugfixes
- Fixed a bug that could leak IPAM entries when a network was removed (#22034).
- Fixed a bug that could cause the rootless network namespace to not be cleaned up on if an error occurred during setup resulting in errors relating to a missing resolv.conf being displayed (#22168).
- Fixed a bug where Podman would use rootless network namespace logic for nested containers (#22218).
- Fixed a bug where writing to volumes on a Mac could result in EACCESS failures when using the :z or :Z volume mount options on a directory with read only files (#19852)
API
- Fixed a bug in the Compat List endpoint for Networks which could result in a server crash due to concurrent writes to a map (#22330).

Bugfixes
- Fixed a bug where rootless containers using the Pasta network driver did not properly handle localhost DNS resolvers on the host leading to DNS resolution issues (#22044).
- Fixed a bug where Podman would warn that cgroups v1 systems were no longer supported on FreeBSD hosts.
- Fixed a bug where HyperV podman machine VMs required an SSH client be installed on the system (#22075).
- Fixed a bug that prevented the remote Podman client's podman build command from working properly when connecting from a rootless client to a rootful server (#22109).
Misc
- The HyperV driver to podman machine now fails immediately if admin privileges are not available (previously, it would only fail when it reached operations that required admin privileges).

Features
- The podman container commit command now features a --config option which accepts a filename containing a JSON-encoded container configuration to be merged in to the newly-created image.

Security
- This release addresses a number of Buildkit vulnerabilities including but not limited to: CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653.
Misc
- Updated Buildah to v1.33.5
- Updated the containers/common library to v0.57.4

Bugfixes
- Fixed a bug where the --rootful option to podman machine set would not set the machine to use the root connection (#21195).
- Fixed a bug where podman would crash when running in a containerized environment with euid != 0 and capabilities set (#20766).
- Fixed a bug where the podman info command would crash on if called multiple times when podman was running as euid=0 without CAP_SYS_ADMIN (#20908).
- Fixed a bug where podman machine commands were not relayed to the correct machine on AppleHV (#21115).
- Fixed a bug where the podman machine list and podman machine inspect commands would not show the correct Last Up time on AppleHV (#21244).
Misc
- Updated the Mac pkginstaller QEMU to v8.2.1
- Updated Buildah to v1.33.4
- Updated the containers/image library to v5.29.2
- Updated the containers/common library to v0.57.3

Features
- The podman farm suite of commands for multi-architecture builds is now fully enabled and documented.
- Add a network recovery service to Podman Machine VMs using the QEMU backend to detect and recover from an inoperable host networking issues experienced by Mac users when running for long periods of time.
Bugfixes
- Fixed a bug where the HyperV provider for podman machine did not forward the API socket to the host machine.
- Fixed a bug where improperly formatted annotations passed to podman kube play could cause Podman to panic.
- Fixed a bug where podman system reset could fail if non-Podman containers (e.g. containers created by Buildah) were present.
Misc
- Containers run in podman machine VMs now default to a PID limit of unlimited, instead of 2048.

Security
- Fixed GHSA-45x7-px36-x8w8: CVE-2023-48795 by vendoring golang.org/x/crypto v0.17.0.

Bugfixes
- Fixed a bug in the MacOS pkginstaller where Podman machine was using a different QEMU binary than the one installed using the installer, if it existed on the system (#20808).
- Fixed a bug on Windows (WSL) with the first-time install of user-mode networking when using the init command, as opposed to set (#20921).

Quadlet
- Fixed a bug where Kube image build failed when starting service with missing image (#20432).

Bugfixes
- Fixed a bug on Windows (WSL) where wsl.conf/resolv.conf was not restored when user-mode networking was disabled after being enabled (#20625).
- Fixed a bug where currently if user specifies podman kube play --replace, the pod is removed on the client side, not the server side (#20705).
- Fixed a bug where podman machine rm -f would cause a deadlock when running with WSL.
- Fixed database is locked errors with the new sqlite database backend (#20809).
- Fixed a bug where podman-remote exec would fail if the server API version is older than 4.8.0 (#20821).
- Fixed a bug where Podman would not run any command on systems with a symlinked $HOME (#20872).

Features
- Podman machine now supports HyperV as a provider on Windows. This option can be set via the CONTAINERS_MACHINE_PROVIDER environment variable, or via containers.conf. HyperV requires Powershell to be run as Admin. Note that running WSL and HyperV machines at the same time is not supported.
- The podman build command now supports Containerfiles with heredoc syntax.
- The podman login and podman logout commands now support a new option, --compat-auth-file, which allows for editing Docker-compatible config files (#18617).
- The podman machine init and podman machine set commands now support a new option, --usb, which sets allows USB passthrough for the QEMU provider (#16707).
- The --ulimit option now supports setting -1 to indicate the maximum limit allowed for the current process (#19319).
- The podman play kube command now supports the BUILDAH_ISOLATION environment variable to change build isolation when the --build option is set (#20024).
- The podman volume create command now supports --opt o=size=XYZ on tmpfs file systems (#20449).
- The podman info command for remote calls now reports client information even if the remote connection is unreachable
- Added a new field, privileged, to containers.conf, which sets the defaults for the --privileged flag when creating, running or exec'ing into a container.
- The podman kube play command now supports setting DefaultMode for volumes (#19313).
- The --opt option to the podman network create command now accepts a new driver specific option, vrf, which assigns a VRF to the bridge interface.
- A new option --rdt-class=COS has been added to the podman create and podman run commands that enables assigning a container to a Class Of Service (COS). The COS has to be pre-configured based on a pseudo-filesystem created by the resctrl kernel driver that enables interacting with the Intel RDT CAT feature.
- The podman kube play command now supports a new option, --publish-all, which exposes all containerPorts on the host.
- The --filter option now supports label!=, which filters for containers without the specified label.

Upcoming Deprecations
- We are beginning development on Podman 5.0, which will include a number of breaking changes and deprecations. We are still finalizing what will be done, but a preliminary list is below. Please note that none of these changes are present in Podman 4.8; this is a preview of upcoming changes.
- Podman 5.0 will deprecate the BoltDB database backend. Exact details on the transition to SQLite are still being decided - expect more news here soon.
- The containers.conf configuration file will be broken up into multiple separate files, ensuring that it will never be rewritten by Podman.
- Support for the CNI network backend and Cgroups V1 are being deprecated and gated by build tags. They will not be enabled in Podman builds by default.
- A variety of small breaking changes to the REST API are planned, both to improve Docker compatibility and to better support containers.conf settings when creating and managing containers.

Changes
- Podman now defaults to sqlite as its database backend. For backwards compatibility, if a boltdb database already exists on the system, Podman will continue using it.
- RHEL Subscriptions from the host now flow through to quay.io/podman/* images.
- The --help option to the podman push command now shows the compression algorithm used.
- The remote Podman client’s commit command now shows progress messages (#19947).
- The podman kube play command now sets the pod hostname to the node/machine name when hostNetwork=true in k8s yaml (#19321).
- The --tty,-t option to the podman exec command now defines the TERM environment variable even if the container is not running with a terminal (#20334).
- Podman now also uses the helper_binaries_dir option in containers.conf to lookup the init binary (catatonit).
- Podman healthcheck events are now logged as notices.
- Podman machines no longer automatically update, preventing accidenta

Security
- Fixed GHSA-jq35-85cj-fj4p.

Bugfixes
- WSL: Fixed podman compose command.
- Fixed a bug in podman compose to try all configured providers before throwing an error (#20502).

Bugfixes
- Fixed a bug involving non-English locales of Windows where machine installs using user-mode networking were rejected due to erroneous version detection (#20209).
- Fixed a regression in --env-file handling (#19565).
- Fixed a bug where podman inspect would fail when stat'ing a device failed.

API
- The network list compat API endpoint is now much faster (#20035).

Security
- Now the io.containers.capabilities LABEL in an image can be an empty string.

Features
- New command set: podman farm [create,list,remove,update] has been created to "farm" out builds to machines running Podman for different architectures.
- New command: podman compose as a thin wrapper around an external compose provider such as docker-compose or podman-compose.
- FreeBSD: podman run --device is now supported.
- Linux: Add a new --module flag for Podman.
- Podmansh: Timeout is now configurable using the podmansh_timeout option in containers.conf.
- SELinux: Add support for confined users to create containers but restrict them from creating privileged containers.
- WSL: Registers shared socket bindings on Windows, to allow other WSL distributions easy remote access (#15190).
- WSL: Enabling user-mode-networking on older WSL2 generations will now detect an error with upgrade guidance.
- The podman build command now supports two new options: --layer-label and --cw.
- The podman kube generate command now supports generation of k8s DaemonSet kind (#18899).
- The podman kube generate and podman kube play commands now support the k8s TerminationGracePeriodSeconds field (RH BZ#2218061).
- The podman kube generate and podman kube play commands now support securityContext.procMount: Unmasked (#19881).
- The podman generate kube command now supports a --podman-only flag to allow podman-only reserved annotations to be used in the generated YAML file. These annotations cannot be used by Kubernetes.
- The podman kube generate now supports a --no-trunc flag that supports YAML files with annotations longer than 63 characters. Warning: if an annotation is longer than 63 chars, then the generated yaml file is not Kubernetes compatible.
- An infra name annotation io.podman.annotations.infra.name is added in the generated yaml when the pod create command has --infra-name set. This annotation can also be used with kube play when wanting to customize the infra container name (#18312).
- The syntax of --uidmap and --gidmap has been extended to lookup the parent user namespace and to extend default mappings (#18333).
- The podman kube commands now support the List kind (#19052).
- The podman kube play command now supports environment variables in kube.yaml (#15983).
- The podman push and podman manifest push commands now support the --force-compression optionto prevent reusing other blobs (#18860).
- The podman manifest push command now supports --add-compression to push with compressed variants.
- The podman manifest push command now honors the add_compression field from containers.conf if --add-compression is not set.
- The podman run and podman create --mount commands now support the ramfs type (#19659).
- When running under systemd (e.g., via Quadlet), Podman will extend the start timeout in 30 second steps up to a maximum of 5 minutes when pulling an image.
- The --add-host option now accepts the special string host-gateway instead of an IP Address, which will be mapped to the host IP address.
- The podman generate systemd command is deprecated. Use Quadlet for running containers and pods under systemd.
- The podman secret rm command now supports an --ignore option.
- The --env-file option now supports multiline variables (#18724).
- The --read-only-tmpfs flag now affects /dev and /dev/shm as well as /run, /tmp, /var/tmp (#12937).
- The Podman --mount option now supports bind mounts passed as globs.
- The --mount option can now be specified in containers.conf using the mounts field.
- The podman stats now has an --all option to get all containers stats (#19252).
- There is now a new --sdnotify=healthy policy where Podman sends the READY message once the container turns healthy (#6160).
- Temporary files created when dealing with images in /var/tmp will automatically be cleaned up on reboot.
- There is now a new filter option since for podman volume ls and podman volume prune (#19228).
- The podman inspect command now has tab-completi

Changes
- Fixed a performance issue when calculating diff sizes in overlay. The podman system df command should see a significant performance improvement (#19467).

Bugfixes
- Fixed a bug where containers in a pod would use the pod restart policy over the set container restart policy (#19671).

API
- Fixed a bug in the Compat Build endpoint where the pull query parameter did not parse 0/1 as a boolean (#17778).

Misc
- Updated the containers/storage library to v1.48.1

Quadlet
- Quadlet now selects the first Quadlet file found when multiple Quadlets exist with the same name.

API
- Fixed a bug in the container kill endpoint to correctly return 409 when a container is not running (#19368).

Misc
- Updated Buildah to v1.31.2
- Updated the containers/common library to v0.55.3

Security
- Do not include image annotations when building spec. These annotations can have security implications - crun, for example, allows rootless containers to preserve the user's groups through an annotation.

Quadlet
- Fixed a bug in quadlet to recognize the systemd optional prefix '-'.

Bugfixes
- Fixed a bug where fully resolving symlink paths included the version number, breaking the path to homebrew-installed qmeu files (#18111).
- Fixed a bug where Podman was splitting the filter map slightly differently compared to Docker (#18092).
- Fixed a bug where running make package did not work on RHEL 8 environments (#18421).
- Fixed a bug to allow comma separated dns server IP addresses in podman network create --dns and podman network update --dns-add/--dns-drop (#18663).
- Fixed a bug to correctly stop containers created with --restart=always in all cases (#18259).
- Fixed a bug in podman-remote logs to correctly display errors reported by the server.
- Fixed a bug to correctly tear down the network stack again when an error happened during the setup.
- Fixed a bug in the remote API exec inspect call to correctly display updated information, e.g. when the exec process died (#18424).
- Fixed a bug so that podman save on windows can now write to stdout by default (#18147).
- Fixed a bug where podman machine rm with the qemu backend now correctly removes the machine connection after the confirmation message not before (#18330).
- Fixed a problem where podman machine connections would try to connect to the ipv6 localhost ipv6 (::1) (#16470).

API
- Fixed a bug in the compat container create endpoint which could result in a "duplicate mount destination" error when the volume path was not "clean", e.g. included a final slash at the end. (#18454).
- The compat API now correctly accpets a tag in the images/create?fromSrc endpoint (#18597).

Features
- The podman kube play command now supports the hostIPC field (#17157).
- The podman kube play command now supports a new flag, --wait, that keeps the workload running in foreground until killed with a sigkill or sigterm. The workloads are cleaned up and removed when killed (#14522).
- The podman kube generate and podman kube play commands now support SELinux filetype labels.
- The podman kube play command now supports sysctl options (#16711).
- The podman kube generate command now supports generating the Deployments (#17712).
- The podman machine inspect command now shows information about named pipe addresses on Windows (#16860).
- The --userns=keep-id option for podman create, run, and kube play now works for root containers by copying the current mapping into a new user namespace (#17337).
- A new command has been added, podman secret exists, to verify if a secret with the given name exists.
- The podman kube generate and podman kube play commands now support ulimit annotations (#16404).
- The podman create, run, pod create, and pod clone commands now support a new option, --shm-size-systemd, that allows limiting tmpfs sizes for systemd-specific mounts (#17037).
- The podman create and run commands now support a new option, --group-entry which customizes the entry that is written to the /etc/group file within the container when the --user option is used (#14965).
- The podman create and podman run commands now support a new option, --security-opt label=nested, which allows SELinux labeling within a confined container.
- A new command, podman machine os apply has been added, which applies OS changes to a Podman machine, from an OCI image.
- The podman search command now supports two new options: --cert-dir and --creds.
- Defaults for the --cgroup-config option for podman create and podman run can now be set in containers.conf.
- Podman now supports auto updates for containers running inside a pod (#17181).
- Podman can now use a SQLite database as a backend for increased stability. The default remains the old database, BoltDB. The database to use is selected through the database_backend field in containers.conf.
- Netavark plugin support has been added. The netavark network backend now allows users to create custom network drivers. podman network create -d <plugin> can be used to create a network config for your plugin and then Podman will use it like any other config and takes care of setup/teardown on container start/stop. This requires at least Netavark version 1.6.
- DHCP with macvlan and the netavark backend is now supported.

Changes
- Remote builds using the podman build command no longer allows .containerignore or .dockerignore files to be symlinks outside the build context.
- The podman system reset command now clears build caches.
- The podman play kube command now adds ctrName as an alias to the pod network (#16544).
- The podman kube generate command no longer adds hostPort to the pod spec when generating service kinds.
- Using a private cgroup namespace with systemd containers on a cgroups v1 system will explicitly error (this configuration has never worked) (#17727).
- The SYS_CHROOT capability has been re-added to the default set of capabilities.
- Listing large quantities of images with the podman images command has seen a significant performance improvement (#17828).

Quadlet
- Quadlet now supports the Rootfs= option, allowing containers to be based on rootfs in addition to image.
- Quadlet now supports the Secret key in the Container group.
- Quadlet now supports the Logdriver key in .container and .kube units.
- Quadlet now supports the Mount key in .container files (#17632).
- Quadlet now supports specifying static IPv4 and IPv6 addresses in .container files via the IP= and IP6= options.
- Quadlet now supports health check configuration in .container files.
- Quadlet now supports relative paths in the Volume key in .container files (#17418).
- Quadlet now supports setting the UID and GID options

Changes
- Podman now writes direct mappings for idmapped mounts.

Bugfixes
- Fixed a regression which caused the MacOS installer to fail if podman-mac-helper was already installed (https://github.com/containers/podman/issues/17910).

Security
- This release fixes CVE-2022-41723, a vulnerability in the golang.org/x/net package where a maliciously crafted HTTP/2 stream could cause excessive CPU consumption, sufficient to cause a denial of service.

Changes
- Added SYS_CHROOT back to the default set of capabilities.

Bugfixes
- Fixed a bug where quadlet would not use the default runtime set.
- Fixed a bug where podman system service --log-level=trace did not hijack the client connection, causing remote podman run/attach calls to work incorrectly (#17749).
- Fixed a bug where the podman-mac-helper returned an incorrect exit code after erroring. podman-mac-helper now exits with 1 on error (#17785).
- Fixed a bug where podman run --dns ... --network would not respect the dns option. Podman will no longer add host nameservers to resolv.conf when aardvark-dns is used (#17499).
- Fixed a bug where podman logs errored out with the passthrough driver when the container was run from a systemd service.
- Fixed a bug where --health-on-failure=restart would not restart the container when the health state turned unhealthy (#17777).
- Fixed a bug where podman machine VMs could have their system time drift behind real time. New machines will no longer be affected by this (#11541).

API
- Fixed a bug where creating a network with the Compat API would return an incorrect status code. The API call now returns 409 when creating a network with an existing name and when CheckDuplicate is set to true (#17585).
- Fixed a bug in the /auth REST API where logging into Docker Hub would fail (#17571).

Misc
- Updated the containers/common library to v0.51.1
- Updated the Mac pkginstaller QEMU to v7.2.0

Security
- This release fixes CVE-2023-0778, which allowed a malicious user to potentially replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

Bugfixes
- Fixed a bug where containers started via the podman-kube systemd template would always use the "passthrough" log driver (#17482).
- Fixed a bug where pulls would unexpectedly encounter an EOF error. Now, Podman automatically transparently resumes aborted pull connections.
- Fixed a race condition in Podman's signal proxy.

Misc
- Updated the containers/image library to v5.24.1.

Changes
- Added the podman-systemd.unit man page, which can also be displayed using man quadlet (#17349).
- Documented journald identifiers used in the journald backend for the podman events command.

Bugfixes
- Fixed a bug where the default handling of pids-limit was incorrect.
- Fixed a bug where parallel calls to make docs crashed (#17322).
- Fixed a regression in the podman kube play command where existing resources got mistakenly removed.

Bugfixes
- Fixed a deadlock between the podman ps and podman container inspect commands

Misc
- Updated the containers/image library to v5.23.1

Features
- Added support for Sigstore signatures (sigstoreSigned) to the podman image trust set and podman image trust show commands.`
- The podman image trust show command now recognizes new lookaside field names.
- The podman image trust show command now recognizes keyPaths in signedBy entries.

Changes
- BREAKING CHANGE: podman image trust show may now show multiple entries for the same scope, to better represent separate requirements. GPG IDs on a single row now always represent alternative keys, only one of which is required; if multiple sets of keys are required, each is re
- presented by a single line.
- The podman generate kube command no longer adds the bind-mount-options annotation to generated Service YAML (#15208).

Bugfixes
- Fixed a bug where Podman could deadlock when using podman kill to send signals to containers (#15492).
- Fixed a bug where the podman image trust set command would silently discard unknown fields.
- Fixed a bug where the podman image trust show command would not show signature enforcement configuration for the default scope.
- Fixed a bug where the podman image trust show command would silently ignore multiple kinds of requirements in a single scope.
- Fixed a bug where a typo in the podman-kube@.service unit file would cause warnings when running systemctl status on the unit.
- Fixed a bug where the --compress option to podman image save was incorrectly allowed with the oci-dir format.
- Fixed a bug where the podman container clone command did not properly clone environment variables (#15242).
- Fixed a bug where Podman would not accept environment variables with whitespace in their keys (#15251).
- Fixed a bug where Podman would not accept file paths containing the : character, preventing some commands from being used with podman machine on Windows (#15247).
- Fixed a bug where the podman top command would report new capabilities as unknown.
- Fixed a bug where running Podman in a container could cause fatal errors about an inability to create cgroups (#15498).
- Fixed a bug where the podman generate kube command could generate incorrect YAML when the bind-mount-options was used (#15170).
- Fixed a bug where generated container names were deterministic, instead of random (#15569).
- Fixed a bug where the podman events command would not work with custom --format specifiers (#15648).

API
- Fixed a bug where the Compat List endpoint for Containers did not sort the HostConfig.Binds field as Docker does.
- Fixed a bug where the Compat List endpoint for Containers send the name (instead of ID) of the image the container was based on.
- Fixed a bug where the Compat Connect endpoint for Networks would return an error (instead of 200) when attempting to connect a container to a network it was already connected to (#15499).
- Fixed a bug where the Compat Events endpoint set an incorrect status for image removal events (remove instead of delete) (#15485).

Features
- Podman machine events are now supported on Windows.

Changes
- The output of the podman load command now mirrors that of docker load.

Bugfixes
- Fixed a bug where the podman play kube command could panic if the --log-opt option was used (#13356).
- Fixed a bug where Podman could, under some circumstances, fail to parse container cgroup paths (#14146).
- Fixed a bug where containers created with the --sdnotify=conmon option could send MAINPID twice.
- Fixed a bug where the podman info command could fail when run inside an LXC container.
- Fixed a bug where the pause image of a Pod with a custom ID mappings could not be built (BZ 2083997).
- Fixed a bug where, on podman machine VMs on Windows, containers could be prematurely terminated with API forwarding was not running (#13965).
- Fixed a bug where removing a container with a zombie exec session would fail the first time, but succeed for subsequent calls (#14252).
- Fixed a bug where a dangling ID in the database could render Podman unusable.
- Fixed a bug where containers with memory limits could not be created when Podman was run in a root cgroup (#14236).
- Fixed a bug where the --security-opt option to podman run and podman create did not support the no-new-privileges:true and no-new-privileges:false options (the only supported separator was =, not :) (#14133).
- Fixed a bug where containers that did not create a network namespace (e.g. containers created with --network none or --network ns:/path/to/ns) could not be restored from checkpoints (#14389).
- Fixed a bug where podman-restart.service could, if enabled, cause system shutdown to hang for 90 seconds (#14434).
- Fixed a bug where the podman stats command would, when run as root on a container that had the podman network disconnect command run on it or that set a custom network interface name, return an error (#13824).
- Fixed a bug where the remote Podman client's podman pod create command would error when the --uidmap option was used (#14233).
- Fixed a bug where cleaning up systemd units and timers related to healthchecks was subject to race conditions and could fail.
- Fixed a bug where the default network mode of containers created by the remote Podman client was assigned by the client, not the server (#14368).
- Fixed a bug where containers joining a pod that was created with --network=host would receive a private network namespace (#13763).
- Fixed a bug where podman machine rm --force would remove files related to the VM before stopping it, causing issues if removal was interrupted.
- Fixed a bug where podman logs would omit the last line of a container's logs if the log did not end in a newline (#14458).
- Fixed a bug where network cleanup was nonfunctional for containers which used a custom user namespace and were initialized via API (#14465).
- Fixed a bug where some options (including volumes) for containers that joined pods were overwritten by the infra container (#14454).
- Fixed a bug where the --file-locks option to podman container restore was ignored, such that file locks checkpointed by podman container checkpoint --file-locks were not restored.
- Fixed a bug where signals sent to a Podman attach session with --sig-proxy enabled at the exact moment the container that was attached to exited could cause error messages to be printed.
- Fixed a bug where running the podman machine start command more than once (simultaneously) on the same machine would cause errors.
- Fixed a bug where the podman stats command could not be run on containers that were not running (it now reports all-0s statistics for Docker compatibility) (#14498).

API
- Fixed a bug where images pulled from a private registry could not be accessed via shortname using the Compat API endpoints (#14291).
- Fixed a bug where the Compat Delete API for Images would return an incorrect status code (500) when attempting to delete images that are in use (#14208).
- Fixed a bug where the Compat Build API for Images would include the bu

Security
- This release fixes CVE-2022-27649, where containers run by Podman would have excess inheritable capabilities set.

Changes
- The `podman machine rm --force` command will now remove running machines as well (such machines are shut down first, then removed) (#13448).
- When a `podman machine` VM is started that is using a too-old VM image, it will now start in a reduced functionality mode, and provide instructions on how to recreate it (previously, VMs were effectively unusable) (#13510).

Bugfixes
- Fixed a bug where devices added to containers by the `--device` option to `podman run` and `podman create` would not be accessible within the container.
- Fixed a bug where Podman would refuse to create containers when the working directory in the container was a symlink (#13346).
- Fixed a bug where pods would be created with cgroups even if cgroups were disabled in `containers.conf` (#13411).
- Fixed a bug where the `podman play kube` command would produce confusing errors if invalid YAML with duplicated container named was passed (#13332).
- Fixed a bug where the `podman machine rm` command would not remove the Podman API socket on the host that was associated with the VM.
- Fixed a bug where the remote Podman client was unable to properly resize the TTYs of containers on non-Linux OSes.
- Fixed a bug where rootless Podman could hang indefinitely when starting containers on systems with IPv6 disabled (#13388).
- Fixed a bug where the `podman version` command could sometimes print excess blank lines as part of its output.
- Fixed a bug where the `podman generate systemd` command would sometimes generate systemd services with names beginning with a hyphen (#13272).
- Fixed a bug where locally building the pause image could fail if the current directory contained a `.dockerignore` file (#13529).
- Fixed a bug where root containers in VMs created by `podman machine` could not bind ports to specific IPs on the host (#13543).
- Fixed a bug where the storage utilization percentages displayed by `podman system df` were incorrect (#13516).
- Fixed a bug where the CPU utilization percentages displayed by `podman stats` were incorrect (#13597).
- Fixed a bug where containers created with the `--no-healthcheck` option would still display healthcheck status in `podman inspect` (#13578).
- Fixed a bug where the `podman pod rm` command could print a warning about a missing cgroup (#13382).
- Fixed a bug where the `podman exec` command could sometimes print a `timed out waiting for file` error after the process in the container exited (#13227).
- Fixed a bug where virtual machines created by `podman machine` were not tolerant of changes to the path to the qemu binary on the host (#13394).
- Fixed a bug where the remote Podman client's `podman build` command did not properly handle the context directory if a Containerfile was manually specified using `-f` (#13293).
- Fixed a bug where Podman would not properly detect the use of `systemd` as PID 1 in a container when the entrypoint was prefixed with `/bin/sh -c` (#13324).
- Fixed a bug where rootless Podman could, on systems that do not use `systemd` as init, print a warning message about the rootless network namespace (#13703).
- Fixed a bug where the default systemd unit file for `podman system service` did not delegate all cgroup controllers, resulting in `podman info` queries against the remote API returning incorrect cgroup controllers (#13710).
- Fixed a bug where the `slirp4netns` port forwarder for rootless Podman would only publish the first port of a range (#13643).

API
- Fixed a bug where the Compat Create API for containers did not properly handle permissions for tmpfs mounts (#13108).

Misc
- The static binary for Linux is now built with CGo disabled to avoid panics due to a Golang bug (#13557).
- Updated Buildah to v1.24.3
- Updated the containers/storage library to v1.38.3
- Updated the containers/image library to v5.19.2
- Updated the containers/common library to v0.47.

Bugfixes
- Revert "use GetRuntimeDir() from c/common"

Bugfixes
- Fixed a bug where the `podman exec` command would, under some circumstances, print a warning message about failing to move `conmon` to the appropriate cgroup (#12535).
- Fixed a bug where named volumes created as part of container creation (e.g. `podman run --volume avolume:/a/mountpoint` or similar) would be mounted with incorrect permissions (#12523).
- Fixed a bug where the `podman-remote create` and `podman-remote run` commands did not properly handle the `--entrypoint=""` option (to clear the container's entrypoint) (#12521).