Update module github.com/containers/podman/v5 to v5.6.1 [SECURITY]

[bootc-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containers/podman/v5	v5.0.1 -> v5.6.1

GitHub Vulnerability Alerts

CVE-2024-9407

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

CVE-2025-6032

Impact

The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry (which it does by default since 5.0.0) allowing a possible Man In The Middle attack.

Patches

containers/podman@726b506
Fixed in v5.5.2

Workarounds

Download the disk image manually via some other tool that verifies the TLS connection. Then pass the local image as file path (podman machine init --image ./somepath)

CVE-2025-9566

Impact

The podman kube play command can overwrite host files when the kube file contains a ConfigMap or Secret volume mount and the volume already contains a symlink to a host file.
This allows a malicious container to write to arbitrary files on the host BUT the attacker only controls the target path not the contents that will be written to the file. The contents are defined in the yaml file by the end user.

Requirements to exploit:

podman kube play must be used with a ConfigMap or Secret volume mount AND must be run more than once on the same volume. All the attacker has to do is create the malicious symlink on the volume the first time it is started. After that all following starts would follow the symlink and write to the host location.

Patches

Fixed in podman v5.6.1
containers/podman@43fbde4

Workarounds

Don't use podman kube play with ConfigMap or Secret volume mounts.

PR with test for CI

Adding on 9/8/2025 by @​TomSweeneyRedHat , this is the PR containing the test ihttps://github.com/containers/podman/pull/27001/27001

---

Release Notes

containers/podman (github.com/containers/podman/v5)

v5.6.1

Compare Source

Security

• This release addresses CVE-2025-9566, where Kubernetes YAML run by podman play kube containing ConfigMap and Secret volumes can use crafted symlinks to overwrite content on the host.

Bugfixes

• Fixed a bug where network creation and removal events were displayed incorrectly when the journald events driver was in use.
• Fixed a bug where the --security-opt seccomp=unconfined option was broken on Windows (#​26855).
• Fixed a bug where containers created with a name longer than 64 characters, no explicit hostname, the the container_name_as_hostname option in containers.conf set to true would fail to start.
• Fixed a bug where Podman would fail to start containers when runc 1.3.0 or later was used as the OCI runtime (#​26938).

Misc

• Adjusted the systemd-tmpfiles script to recursively remove temporary files directories placed in /tmp, ensuring proper operation of Podman after a reboot if /tmp is not a tmpfs.
• Updated Buildah to v1.41.4
• Updated the containers/storage to v1.59.1
• Updated the containers/common library to v0.64.2

v5.6.0

Compare Source

Features

• A new set of commands for managing Quadlets has been added as podman quadlet install (install a new Quadlet for the current user), podman quadlet list (list installed Quadlets), podman quadlet print (print the contents of a Quadlet file), and podman quadlet rm (remove a Quadlet). These commands are presently not available with the remote Podman client - we expect support for this to arrive in a future release.
• Quadlet .container units can now specify environment variables without values in the Environment= key, retrieving the value from the host when the container is started (#​26247).
• Quadlet .pod units now support two new keys, Label= (to set labels on the created pod) and ExitPolicy= (to set exit policy for the created pod) (#​25961 and #​25596).
• Quadlet .image units now support a new key, Policy=, to set pull policy for the image (e.g. pull always, pull only if newer version available) (#​26446).
• Quadlet .network units now support a new key, InterfaceName=, to specify the name of the network interface created.
• The podman machine init command now supports a new option, --swap, enabling swap in the created virtual machine and setting it to a given size (in megabytes) (#​15980).
• The --mount option to podman create and podman run now supports dest= as a valid alias for destination=.
• The podman kube play command can now restrict container execution to specific CPU cores and specific memory nodes using the io.podman.annotations.cpuset/$ctrname and io.podman.annotations.memory-nodes/$ctrname annotations (#​26172).
• The podman kube play command now supports the lifecycle.stopSignal field in Pod YAML, allowing the signal used to stop containers to be specified (#​25389).
• The podman artifact suite of commands for interacting with OCI artifacts is now available in the remote Podman client and the bindings for the REST API.
• The podman volume import and podman volume export commands are now available in the remote Podman client (#​26049).
• The --build-context option to podman build is now supported by the remote Podman client (#​23433).
• The podman volume create command now accepts two new options, --uid and --gid, to set the UID and GID the volume will be created with.
• The podman secret create command now has a new option, --ignore, causing the command to succeed even if a secret with the given name already exists.
• The podman pull command now has a new option, --policy, to configure pull policy.
• The --mount type=artifact option to podman create, podman run, and podman pod create now allows the filename of the artifact in the container to be set using the name= option (e.g. podman run --mount type=artifact,name=$NAME,...).
• The --tmpfs option to podman create and podman run now allows a new option, noatime, to be passed (e.g. podman run --tmpfs /run:noatime ...) (#​26102).
• The podman update command now has a new option, --latest, to update the latest container instead of specifying a specific container (#​26380).
• A new command, podman buildx inspect, has been added to improve Docker compatibility (#​13014).

Breaking Changes

• Rosetta support in podman machine VMs has been disabled by default due to issues with newer Linux kernels. These issues have been addressed in the Tahoe beta, and we plan on re-enabling support for Rosetta in a future Podman release once the fix is in wider circulation. You can find more details here.

Changes

• In preparation for a planned removal of the BoltDB database in Podman 6.0, a warning has been added for installations still using BoltDB. These warnings are presently not visible by default, which will happen in Podman 5.7.
• The podman artifact suite of commands for interacting with OCI artifacts is now considered stable.
• For users running podman machine VMs using the libkrun provider on an M3 or newer host running macOS 15+, nested virtualization is enabled by default.
• When creating podman machine VMs on Windows using the WSL v2 provider, images are now pulled as artifacts from quay.io/podman/machine-os, matching the behavior of other VM providers.
• Signal forwarding done by the --sig-proxy option to podman run and podman attach is now more robust to races and no longer forwards the SIGSTOP signal.
• The podman system check --quick command now skips checking layer digests.
• Podman on Windows using the WSLv2 provider now prefers the WSL executable in C:\Program Files\Windows Subsystem for Linux\wsl.exe over the one in WindowsApps, avoiding common “access denied” issues (#​25787).
• The --mount type=artifact option to podman create, podman run, and podman pod create now mounts artifacts containing a only a single blob as a file at the given destination path if the path does not exist in the image.
• The podman volume export command now refuses to export to STDOUT if it is a TTY (#​26506).
• When generating Quadlet units with options known to be problematic when used with Podman, such as User=, Group=, and DynamicUser= in the [Service] section of a unit, Quadlet will now warn the user of the potential incompatibility (#​26543).

Bugfixes

• Fixed a bug where the --security-opt unmask= option to podman create and podman run did not allow comma-separated lists of paths to be passed, instead only allowing a single path.
• Fixed a bug where stopping a Podman container could unintentionally kill non-Podman processes if the PID of an exec session started inside the container was reused for a new process while the container was running (#​25104).
• Fixed a bug where podman machine init could fail if run in a Podman container (#​25950).
• Fixed a bug where podman machine VMs would sometimes receive incorrect timezone information.
• Fixed a bug where podman machine VMs created with a custom username would not have lingering enabled.
• Fixed a bug where the podman machine init command on Windows when using the WSL 2 provider did not reliably determine if WSL was installed (#​25523).
• Fixed a bug where the name of Quadlet .pod units that did not specify the PodName= key was set incorrectly (#​26062).
• Fixed a bug where Quadlet .container units joining a pod specified in a .pod unit would fail as the pod name was set incorrectly when creating the container (#​26105).
• Fixed a bug where Quadlet would not generate RequiresMountsFor when mounting a .volume unit with Type=bind set into a container (#​26125).
• Fixed a bug where Quadlet dropin files were not correctly overwritten by new dropin files with the same name further along the hierarchy if the two dropin files did not share a parent directory (#​26555).
• Fixed a bug where Quadlet would sometimes not print warnings when failing to parse units (#​26542).
• Fixed a bug where Quadlet .pod files did not include the last Environment= key in the [Service] section in the generated systemd service (#​26521).
• Fixed a bug where starting a container with already-running dependencies would fail.
• Fixed a bug where OCI hooks in a directory specified with --hooks-dir would fail to run when containers were restarted (#​17935).
• Fixed a bug where the --mount option to podman create and podman run required the type= option to be specified, instead of defaulting to volume when it was not present (#​26101).
• Fixed a bug where the podman kube play command would fail on Windows when specifying an absolute path to YAML files (#​26350).
• Fixed a bug where the --security-opt seccomp= option to podman create, podman run, and podman pod create could error on Windows when given a path to a Seccomp profile (#​26558).
• Fixed a bug where the --blkio-weight-device, --device-read-bps, --device-write-bps, --device-read-iops, and --device-write-iops options to podman create and podman run incorrectly accepted non-block devices.
• Fixed a bug where the podman build command handled the --ignorefile option differently from the buildah bud command (#​25746).
• Fixed a bug where the podman rm -f command could return an error when trying to remove a running container whose conmon process had been killed (#​26640).
• Fixed a bug where the podman inspect command did not correctly display log size for containers when log_size_max was set in containers.conf.

API

• A full set of API endpoints for interacting with artifacts has been added, including inspecting artifacts (GET /libpod/artifacts/{name}/json), listing all artifacts (GET /libpod/artifacts/json), pulling an artifact (POST /libpod/artifacts/pull), removing an artifact (DELETE /libpod/artifacts/{name}), adding an artifact (or appending to an existing artifact) from a tar file in the request body (POST /libpod/artifacts/add), pushing an artifact to a registry (/libpod/artifacts/{name}/push), and retrieving the contents of an artifact (GET /libpod/artifacts/{name}/extract).
• The Compat Create endpoint for Containers now accepts a new parameter, HostConfig.CgroupnsMode, to specify the cgroup namespace mode of the created container.
• The Compat Create endpoint for Containers now respects the base_hosts_file option in containers.conf.
• The Compat System Info endpoint now returns a new field, DefaultAddressPools.
• The Compat System DF endpoint has removed the deprecated BuilderSize field.
• The Compat Ping endpoint now sets Builder-Version to 1 to match Docker installs that do not include BuildKit.
• The Compat List endpoint for Images now returns the shared-size field unconditionally, even if the shared-size query parameter was not set to true. If not requested through query parameter, it is set to -1. This improves Docker API compatibility.
• The Compat Inspect endpoint for Images now no longer returns the deprecated VirtualSize field when Docker API version 1.44 and up is requested.
• Fixed a bug where the Compat Delete API for Containers would remove running containers when the FORCE parameter was set to true; Docker only removes stopped containers (#​25871).
• Fixed a bug where the Compat List and Compat Inspect endpoints for Containers returned container status using Podman statuses instead of converting to Docker-compatible statuses (#​17728).
• Fixed a bug where healthchecks that exceeded their timeout were not properly terminated; they now receive SIGTERM, then SIGKILL after a delay, if their timeout is exceeded (#​26086).
• Fixed a bug where application/json responses would be HTML escaped, mutating some responses (e.g. <missing> becoming \u003cmissing\u003e in image history responses) (#​17769).

Misc

• Quadlet now no longer uses container/pod ID files when stopping containers, but instead passes the name of the container/pod directly to podman stop/podman pod stop.
• When building Podman via Makefile, it will now attempt to dynamically link sqlite3 if the library and header are installed locally. This and other optimizations should result in a significant reduction in binary size relative to Podman 5.5.x. Packagers can use the libsqlite3 build tag to force this behavior when not using the Makefile to build.
• Updated Buildah to v1.41.3
• Updated the containers/common library to v0.64.1
• Updated the containers/storage library to v1.59.1
• Updated the containers/image library to v5.36.1

v5.5.2

Compare Source

Security

• This release addresses CVE-2025-6032, in which the TLS connection used to pull VM images for podman machine was, by default, not validated, allowing connections to servers with invalid certificates by default and potentially allowing a Man in the Middle attack.

Bugfixes

• Fixed a bug where Podman could panic after a reboot on systems with pods containing containers (#​26469).

v5.5.1

Compare Source

Bugfixes

• Fixed a bug where containers mounting a volume to / could overmount important directories such as /proc causing start and/or runtime failures due to an issue with mount ordering (#​26161).
• Fixed a bug where Quadlet .pod units could fail to start due to their storage not being mounted (#​26190).
• Fixed a bug where containers joined to a network with DNS enabled would not include the host's search domains in their resolv.conf (#​24713).
• Fixed a bug where the --dns-opt option to podman create, podman run, and podman pod create would append options to the container's resolv.conf, instead of replacing them (#​22399).
• Fixed a bug where the podman kube play command would add an empty network alias for containers created with no name specified, causing Netavark to emit extraneous warnings.
• Fixed a bug where the podman system df command would panic when one or more containers were created using a root filesystem (the --rootfs option to podman create and podman run) instead of from an image (#​26224).
• Fixed a bug where the log_tag field in containers.conf would override the --log-opt tag=value option to podman create and podman run (#​26236).
• Fixed a bug where the podman volume rm and podman volume inspect commands would incorrectly handle volume names containing the _ character when the SQLite database backend was in use (#​26168).
• Fixed a bug where the Podman remote client on Windows was unable to mount local folders into containers using overlay mounts (-v source:destination:O) (#​25988).

API

• Fixed a bug in the Libpod Create API for Containers where rlimits specified with a value of -1 were causing errors, instead of being interpreted as the maximum possible value (#​24886).
• Fixed a bug in the Compat Create API for Containers where specifying an entrypoint of [] (an empty array) was ignored, instead of setting an empty entrypoint (#​26078).

Misc

• Updated Buildah to v1.40.1
• Updated the containers/common library to v0.63.1

v5.5.0

Compare Source

Features

• A new command has been added, podman machine cp, to copy files into a running podman machine VM.
• A new command has been added, podman artifact extract, to copy some or all of the contents of an OCI artifact to a location on disk.
• The --mount option to podman create, podman run, and podman pod create now supports a new mount type, --mount type=artifact, to mount OCI artifacts into containers.
• The podman artifact add command now features two new options, --append (to add new files to an existing artifact) and --file-type (to specify the MIME type of the file added to the artifact) (#​25884).
• The podman artifact rm command now features a new option, --all, to remove all artifacts in the local store.
• The --filter option to podman pause, podman ps, podman restart, podman rm, podman start, podman stop, and podman unpause now accepts a new filter, command, which filters on the first element (argv[0]) of the command run in the container.
• The podman exec command now supports a new option, --cidfile, to specify the ID of the container to exec into via a file (#​21256).
• The podman kube generate and podman kube play commands now supports a new annotation, io.podman.annotation.pids-limit/$containername, preserving the PID limit for containers across kube generate and kube play (#​24418).
• Quadlet .container units now support three new keys, Memory= (set maximum memory for the created container), ReloadCmd (execute a command via systemd ExecReload), and ReloadSignal (kill the container with the given signal via systemd ExecReload) (#​22036).
• Quadlet .container, .image, and .build units now support two new keys, Retry (number of times to retry pulling image on failure) and RetryDelay (delay between retries) (#​25109).
• Quadlet .pod units now support a new key, HostName=, to set the pod's hostname (#​25639).
• Quadlet files now support a new option, UpheldBy, in the Install section, corresponding to the systemd Upholds option.
• The names of Quadlet units specified as systemd dependencies are now automatically translated - e.g. Wants=my.container is now valid.
• Podman now generates events for the creation and removal of secrets (#​24030).
• A new global option has been added to Podman, --cdi-spec-dir, to specify additional search paths for CDI specs to the CDI loader (#​18292 and #​25691).
• The podman build command now supports a new option, --inherit-labels (defaults to true), which controls whether labels are inherited from the base image or base stages.
• The podman update command now supports two new options, --env and --unsetenv, to alter the environment variables of existing containers (#​24875).

Breaking Changes

• Due to changes in Docker API types, two small breaking changes have been made in the Go bindings for the REST API. The containers.Commit() function now returns a new struct (types.IDResponse) with identical contents, and the containers.ExecCreate function's handlers.ExecCreateConfig parameter now contains a different embedded struct, potentially requiring changes to how it is assigned to.

Changes

• Podman now requires at least Go 1.23 to build.
• Healthchecks have been refactored to avoid writing to the database as much as possible, greatly improving performance on systems with many simultaneous healthchecks running.
• Healthchecks now have a new status, stopped, which is reported if the container the healthcheck was run on stopped before the check could be completed (#​25276).
• Containers in pods are now stopped in order based on their dependencies, with the infra container being stopped last, preventing application containers from losing networking before they are stopped due to the infra container stopping prematurely.
• Due to challenges with handling automatic installation, the Windows installer no longer installs WSLv2 or Hyper-V.
• Quadlet will now print warnings when skipping lines to help identify malformed Quadlet files (#​25339).
• Creating podman machine VMs with a host mount over the VM's /tmp directory is no longer allowed (#​18230).
• The podman logs command now allows options to be specified after the container name (e.g. podman logs $containername --follow) (#​25653).
• Podman, by default, no longer uses a pause image for pod infra and service containers. Instead, a root filesystem containing only the catatonit binary will be used (#​23292).
• The podman system reset command no longer removes the user's podman.sock API socket.
• When using Netavark v1.15 and higher, containers in non-default networks will no longer have the default search domain dns.podman added. Queries resolving such names will still work.
• Stopping a Quadlet .network unit will now delete the network (if no containers are actively using it) (#​23678).
• For security hardening, the /proc/interrupts and /sys/devices/system/cpu/$CPU/thermal_throttle paths are now masked by default in containers (#​25634).

Bugfixes

• Fixed a bug where healthchecks would still run while a container was paused (#​24590).
• Fixed a bug where the remote Podman client on Windows could not mount named volumes with a single-character name into containers (#​25218).
• Fixed a bug where mounting an image could panic when run without CAP_SYS_ADMIN (#​25241).
• Fixed a bug where Podman would not report errors when setting up healthchecks (#​25034).
• Fixed a bug where the podman exec command would not add the additional groups of the user the exec session was run as unless the user was explicitly added with the --user option (#​25610).
• Fixed a bug where errors during the podman network connect and podman network disconnect commands could create errors in the database which would cause podman inspect on the container to fail.
• Fixed a bug where the podman kube generate command did not correctly generate YAML for volume mounts using a subpath.
• Fixed a bug where the podman system df command could show a negative reclaimable size.
• Fixed a bug where accessing a rootful podman machine VM that was not podman-machine-default (the default VM) with the podman machine ssh command would put the user into the rootless shell (#​25332).
• Fixed a bug where the podman machine init would report nonsensical memory values in error messages when trying to create a machine with more memory than the system.
• Fixed a bug where the remote Podman client's podman start --attach command would incorrectly print an error when run on a container created with the --rm option (#​25965).
• Fixed a bug where the remote Podman client's podman pull command could hang and leak memory if the server was unexpectedly stopped or encountered an error during a pull.
• Fixed a bug where the remote Podman client's podman cp command would, on Windows, often fail to copy files into the container due to improper handling of Windows paths (#​14862).
• Fixed a bug where the podman container clone command did not correctly copy healthcheck settings to the new container (#​21630).
• Fixed a bug where the podman kube play command would fail to start empty pods (#​25786).
• Fixed a bug where the podman volume ls command did not output headers when no volumes were present (#​25911).
• Fixed a bug where healthcheck configuration provided by a container's image could not be overridden unless the --health-cmd option was specified when creating the container (#​20212).
• Fixed a bug where the --user option to podman create and podman run could not be used with users added to the container by the --hostuser option (#​25805).
• Fixed a bug where the podman system reset command on FreeBSD would incorrectly print an error.
• Fixed a bug where stopping the podman machine start command with SIGINT could result in machine state being incorrectly set to "Starting" (#​24416).
• Fixed a bug where the podman machine start command would fail when starting a VM with volume mounts containing spaces using the HyperV machine provider (#​25500).

API

• Fixed a bug where the Compat Create API for Containers ignored ulimits specified in the request when Podman was run rootless (#​25881).

Misc

• Erroneous errors from the ExecStartAndAttach() function in the Go bindings for the REST API have been silenced, where the function would incorrectly report errors when stdin was consumed after the exec session was stopped (#​25344).
• Updated Buildah to v1.40.0
• Updated the containers/common library to v0.63.0
• Updated the containers/image library to v5.35.0
• Updated the containers/storage library to v1.58.0

v5.4.2

Compare Source

Bugfixes

• Fixed a bug where the podman import command could not import images compressed with algorithms other than gzip (#​25593).
• Fixed a bug where the podman cp command could deadlock when copying into a non-empty volume on a container that is not running (#​25585).

API

• Fixed a bug where the default values for some fields in the Libpod Create endpoint for Containers did not have sensible defaults for some healthcheck fields, causing unrestricted log growth for containers which did not set these fields (#​25473).

Misc

• Updated vendored Buildah to v1.39.4
• Updated the containers/common library to v0.62.3
• Updated the containers/image library to v5.34.3
• Updated the containers/storage library to v1.57.2

v5.4.1

Compare Source

Bugfixes

• Fixed a bug where volume quotas were not being applied (#​25368).
• Fixed a bug where the --pid-limit=-1 option did not function properly with containers using the runc OCI runtime.
• Fixed a bug where the podman artifact pull command did not respect the --retry-delay option.
• Fixed a bug where Podman would leak a file and directory for every container created.
• Fixed a bug where the podman wait command would sometimes error when waiting for a container set to auto-remove.
• Fixed a bug where Quadlet .kube units would not report an error (and stay running) even when a pod failed to start (#​20667).

API

• Fixed a bug where the Compat DF endpoint did not correctly report total size of all images.

Misc

• Updated Buildah to v1.39.2
• Updated the containers/common library to v0.62.1
• Updated the containers/image library to v5.34.1

v5.4.0

Compare Source

Features

• A preview of Podman's support for OCI artifacts has been added through the podman artifact suite of commands, including add, inspect, ls, pull, push, and rm. This support is very early and not fully complete, and the command line interface for these tools has not been finalized. We welcome feedback on the new artifact experience through our issue tracker!
• The podman update command now supports a wide variety of options related to healthchecks (including --health-cmd to define a new healthcheck and --no-healthcheck to disable an existing healthcheck), allowing healthchecks to be added to, removed from, and otherwise updated on existing containers. You can find full details on the 15 added options in the manpage.
• The --mount type=volume option for the podman run, podman create, and podman volume create commands now supports a new option, subpath=, to make only a subset of the volume visible in the container (#​20661).
• The --userns=keep-id option for the podman run, podman create, and podman pod create commands now supports a new option, --userns=keep-id:size=, to configure the size of the user namespace (#​24387).
• The podman kube play command now supports Container Device Interface (CDI) devices (#​17833).
• The podman machine init command now supports a new option, --playbook, to run an Ansible playbook in the created VM on first boot for initial configuration.
• Quadlet .pod files now support a new field, ShmSize, to specify the size of the pod's shared SHM (#​22915).
• The podman run, podman create, and podman pod create commands now support a new option, --hosts-file, to define the base file used for /etc/hosts in the container.
• The podman run, podman create, and podman pod create commands now support a new option, --no-hostname, which disables the creation of /etc/hostname in the container (#​25002).
• The podman network create command now supports a new option for bridge networks, --opt mode=unmanaged, which allows Podman to use an existing network bridge on the system without changes.
• The --network option to podman run, podman create, and podman pod create now accepts a new option for bridge networks, host_interface_name, which specifies a name for the network interface created outside the container.
• The podman manifest rm command now supports a new option, --ignore, to not error when removing manifests that do not exist.
• The podman system prune command now supports a new option, --build, to remove build containers leftover from prematurely terminated builds.
• The podman events command now generates events for the creation and removal of networks (#​24032).

Breaking Changes

• Due to a lack of availability of hardware to test on, the Podman maintainers are no longer capable of providing full support for Podman on Intel Macs. Binaries and machine images will still be produced, and pull requests related to MacOS on Intel systems will still be merged, but bugs will be fixed on a best effort basis only. We welcome any potential new maintainers who would be able to assist in restoring full support.
• Quadlet previously incorrectly allowed : as a character to define comments. This was a mistake; developer intent and documentation was that # and ; were to be used as comment characters instead, matching systemd. This has been corrected, and semicolons now define comments instead of colons.

Changes

• Podman now passes container hostnames to Netavark, which will use them for any DHCP requests for the container.
• Partial pulls of zstd:chunked images now only happen for images that have a RootFS.DiffID entry in the image's OCI config JSON, and require the layer contents to match. This resolves issues with image ID ambiguity when partial pulls were enabled.
• Packagers can now set the BUILD_ORIGIN environment variable when building podman from the Makefile. This provides information on who built the Podman binary, and is displayed in podman version and podman info. This will help upstream bug reports, allowing maintainers to trace how and where the binary was built and installed from.

Bugfixes

• Fixed a bug where podman machine VMs on WSL could fail to start when using usermode networking could fail to start due to a port conflict (#​20327).
• Fixed a bug where overlay mounts could not be made at paths where the image specifies a volume (#​24555).
• Fixed a bug where the podman build command did not honor the no_pivot_root setting from containers.conf (#​24546).
• Fixed a bug where volumes would have the wrong permissions if podman cp was used to copy into a fresh volume in a container that had never been started.
• Fixed a bug where using podman cp to copy into a named volume requiring a mount (image volumes, volumes backed by a volume plugin, or other volumes with options) would fail when the container being copied into was stopped.
• Fixed a bug where rlimits would be set incorrectly when Podman was run as root but without CAP_SYS_RESOURCE (#​24692).
• Fixed a bug where the podman stats --all command would fail if a container started with --cgroups=none was present (#​24632).
• Fixed a bug where the podman info command would only return details on one image store even if additional image stores were configured in storage.conf.
• Fixed a bug where the podman update command could reset resource limits that were not being modified to default (#​24610).
• Fixed a bug where the remote Podman client's podman update command could not update resource limits on devices mounted into the container (#​24734).
• Fixed a bug where the podman manifest annotate command could panic when the --index option was used (#​24750).
• Fixed a bug where a Quadlet container reusing another container's network could cause errors if the second container was not already running.
• Fixed a bug where Quadlet files containing lines with a trailing backslash could cause an infinite loop during parsing (#​24810).
• Fixed a bug where Quadlet would, when run as a non-root user, not generate for files in subfolders of /etc/containers/systemd/users/ (#​24783).
• Fixed a bug where values in Quadlet files containing octal escape sequences were incorrectly unescaped.
• Fixed a bug where podman generate kube could generate persistent volumes with mixed-case names or names containing an underscore, which are not supported by Kubernetes (#​16542).
• Fixed a bug where the ptmxmode option to --mount type=devpts did not function.
• Fixed a bug where shell completion on Windows would include .exe in the executable name, breaking completion on some shells.
• Fixed a bug where the output of podman inspect on containers did not include the ID of the network the container was joined to, improving Docker compatibility (#​24910).
• Fixed a bug where containers created with the remote API incorrectly included a create command (#​25026).
• Fixed a bug where it was possible to specify the libkrun backend for VMs on Intel Macs (libkrun only supports Arm systems).
• Fixed a bug where libkrun and applehv VMs from podman machine could be started at the same time on Macs (#​25112).
• Fixed a bug where podman exec commands could not detach from the exec session using the detach keys (#​24895).
• Fixed a bug where Podman would fail to start due to a database configuration mismatch when certain fields were configured to the empty string (#​24738).

API

• The Compat and Libpod Build APIs for Images now support a new query parameter, nohosts, which (when set to true) does not create /etc/hosts in the image when building.
• Fixed a bug where the Compat Create API for Containers did not honor CDI devices, preventing (among other things) the use of GPUs with docker compose (#​19338).

Misc

• The Docker alias script has been fixed to better handle variable substitution.
• Fixed a bug where podman-restart.service functioned incorrectly when no containers were present.
• Updated Buildah to v1.39.0
• Updated the containers/common library to v0.62.0
• Updated the containers/storage library to v1.57.1
• Updated the containers/image library to v5.34.0

v5.3.2

Compare Source

Security

• This release contains Buildah v1.38.1 which addresses CVE-2024-11218

Bugfixes

• Fixed a bug where Quadlet .build files could create an invalid podman command line when Pull= was used (#​24599).
• Fixed a bug where the Mac installer did not install the Podman manpages (#​24756).

Misc

• Updated Buildah to v1.38.1
• Updated the containers/common library to v0.61.1
• Updated the containers/storage library to v1.56.1
• Updated the containers/image library to v5.33.1

v5.3.1

Compare Source

• Fixed a bug where the --ignition-path option to podman machine init would prevent creation of necessary files for the VM, rendering it unusable (#​23544).
• Fixed a bug where rootless containers using the bridge networking mode would be unable to start due to a panic caused by a nil pointer dereference (#​24566).
• Fixed a bug where Podman containers would try to set increased rlimits when started in a user namespace, rendering containers unable to start (#​24508).
• Fixed a bug where certain SSH configurations would make the remote Podman client unable to connect to the server (#​24567).
• Fixed a bug where the Windows installer could install WSLv2 when upgrading an existing Podman installation that used the Hyper-V virtualization backend.

v5.3.0

Compare Source

Features

• The podman kube generate and podman kube play commands can now create and run Kubernetes Job YAML (#​17011).
• The podman kube generate command now includes information on the user namespaces for pods and containers in generated YAML. The podman kube play command uses this information to duplicate the user namespace configuration when creating new pods based on the YAML.
• The podman kube play command now supports Kubernetes volumes of type image (#​23775).
• The service name of systemd units generated by Quadlet can now be set with the ServiceName key in all supported Quadlet files (#​23414).
• Quadlets can now disable their implicit dependency on network-online.target via a new key, DefaultDependencies, supported by all Quadlet files (#​24193).
• Quadlet .container and .pod files now support a new key, AddHost, to add hosts to the container or pod.
• The PublishPort key in Quadlet .container and .pod files can now accept variables in its value (#​24081).
• Quadlet .container files now support two new keys, CgroupsMode and StartWithPod, to configure cgroups for the container and whether the container will be started with the pod it is part of (#​23664 and #​24401).
• Quadlet .container files can now use the network of another container by specifying the .container file of the container to share with in the Network key.
• Quadlet .container files can now mount images managed by .image files into the container by using the Mount=type=image key with a .image target.
• Quadlet .pod files now support six new keys, DNS, DNSOption, DNSSearch, IP, IP6, and UserNS, to configure DNS, static IPs, and user namespace settings for the pod (#​23692).
• Quadlet .image files can now give an image multiple times by specifying the ImageTag key multiple times (#​23781).
• Quadlets can now be placed in the /run/containers/systemd directory as well as existing directories like $HOME/containers/systemd and /etc/containers/systemd/users.
• Quadlet now properly handles subdirectories of a unit directory being a symlink (#​23755).
• The podman manifest inspect command now includes the manifest's annotations in its output.
• The output of the podman inspect command for containers now includes a new field, HostConfig.AutoRemoveImage, which shows whether a container was created with the --rmi option set.
• The output of the podman inspect command for containers now includes a new field, Config.ExposedPorts, which includes all exposed ports from the container, improving Docker compatibility.
• The output of the podman inspect command for containers now includes a new field, Config.StartupHealthCheck, which shows the container's startup healthcheck configuration.
• The output of the podman inspect command for containers now includes a new field in Mounts, SubPath, which contains any subpath set for image or named volumes.
• The podman machine list command now supports a new option, --all-providers, which lists machines from all supported VM providers, not just the one currently in use.
• VMs run by podman machine on Windows will now provide API access by exposing a Unix socket on the host filesystem which forwards into the VM (#​23408).
• The podman buildx prune and podman image prune commands now support a new option, --build-cache, which will also clean the build cache.
• The Windows installer has a new radio button to select virtualization provider (WSLv2 or Hyper-V).
• The --add-host option to podman create, podman run, and podman pod create now supports specifying multiple hostnames, semicolon-separated (e.g. podman run --add-host test1;test2:192.168.1.1) (#​23770).
• The podman run and podman create commands now support three new options for configuring healthcheck logging: --health-log-destination (specify where logs are stored), --health-max-log-count (specify how many healthchecks worth of logs are stored), and --health-max-log-size (specify the maximum size of the healthcheck log).

Changes

• Podman now uses the Pasta --map-guest-addr option by default which is used for the host.containers.internal entry in /etc/hosts to allow containers to reach the host by default (#​19213).
• The names of the infra containers of pods created by Quadlet are changed to the pod name suffixed with -infra (#​23665).
• The podman system connection add command now respects HTTP path prefixes specified with tcp:// URLs.
• Proxy environment variables (e.g. https_proxy) declared in containers.conf no longer escape special characters in their values when used with podman machine VMs (#​23277).
• The podman images --sort=repository command now also sorts by image tag as well, guaranteeing deterministic output ordering (#​23803).
• When a user has a rootless podman machine VM running and second rootful podman machine VM initialized, and the rootless VM is removed, the connection to the second, rootful machine now becomes the default as expected (#​22577).
• Environment variable secrets are no longer contained in the output of podman inspect on a container the secret is used in (#​23788).
• Podman no longer exits 0 on SIGTERM by default.
• Podman no longer explicitly sets rlimits to their default value, as this could lower the actual value available to containers if it had been set higher previously.
• Quadlet user units now correctly wait for the network to be ready to use via a new service, podman-user-wait-network-online.service, instead of the user session's nonfunctional network-online.target.
• Exposed ports in the output of podman ps are now correctly grouped and deduplicated when they are also published (#​23317).
• Quadlet build units no longer use RemainAfterExit=yes by default.

Bugfixes

• Fixed a bug where the --build-context option to podman build did not function properly on Windows, breaking compatibility with Visual Studio Dev Containers (#​17313).
• Fixed a bug where Quadlet would generate bad arguments to Podman if the SecurityLabelDisable or SecurityLabelNested keys were used (#​23432).
• Fixed a bug where the PODMAN_COMPOSE_WARNING_LOGS environment variable did not suppress warnings printed by podman compose that it was redirecting to an external provider.
• Fixed a bug where, if the podman container cleanup command was run on a container in the process of being removed, an error could be printed.
• Fixed a bug where rootless Quadlet units placed in /etc/containers/systemd/users/ would be loaded for root as well when /etc/containers/systemd was a symlink (#​23483).
• Fixed a bug where the remote Podman client's podman stop command would, if called with --cidfile pointing to a non-existent file and the --ignore option set, stop all containers (#​23554).
• Fixed a bug where the podman wait would only exit only after 20 second when run on a container which rapidly exits and is then restarted by the on-failure restart policy.
• Fixed a bug where podman volume rm and podman run -v could deadlock when run simultaneously on the same volume (#​23613).
• Fixed a bug where running podman mount on a container in the process of being created could cause a nonsensical error indicating the container already existed (#​23637).
• Fixed a bug where the podman stop command could deadlock when run on containers with very large annotations ([#​22246](https://redirect.github.com/containers/podman/issues/22246

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[bootc-bot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 98 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.6 -> 1.23.3
github.com/containers/common	v0.58.1 -> v0.64.2
github.com/containers/gvisor-tap-vsock	v0.7.3 -> v0.8.6
github.com/distribution/reference	v0.5.0 -> v0.6.0
github.com/gofrs/flock	v0.8.1 -> v0.12.1
github.com/onsi/ginkgo/v2	v2.17.1 -> v2.23.4
github.com/onsi/gomega	v1.32.0 -> v1.38.0
github.com/spf13/cobra	v1.8.0 -> v1.9.1
golang.org/x/crypto	v0.28.0 -> v0.40.0
golang.org/x/sys	v0.26.0 -> v0.34.0
golang.org/x/term	v0.25.0 -> v0.33.0
dario.cat/mergo	v1.0.0 -> v1.0.2
github.com/Azure/go-ansiterm	v0.0.0-20230124172434-306776ec8161 -> v0.0.0-20250102033503-faa5f7b0171c
github.com/BurntSushi/toml	v1.3.2 -> v1.5.0
github.com/Microsoft/go-winio	v0.6.1 -> v0.6.2
github.com/Microsoft/hcsshim	v0.12.0-rc.3 -> v0.13.0
github.com/cilium/ebpf	v0.11.0 -> v0.17.3
github.com/containerd/cgroups/v3	v3.0.3 -> v3.0.5
github.com/containerd/containerd	v1.7.13 -> v1.7.23
github.com/containerd/errdefs	v0.1.0 -> v1.0.0
github.com/containerd/stargz-snapshotter/estargz	v0.15.1 -> v0.16.3
github.com/containerd/typeurl/v2	v2.1.1 -> v2.2.3
github.com/containers/buildah	v1.35.3 -> v1.41.4
github.com/containers/image/v5	v5.30.0 -> v5.36.2
github.com/containers/libhvee	v0.7.0 -> v0.10.0
github.com/containers/ocicrypt	v1.1.9 -> v1.2.1
github.com/containers/storage	v1.53.0 -> v1.59.1
github.com/crc-org/crc/v2	v2.32.0 -> v2.48.0
github.com/crc-org/vfkit	v0.5.1 -> v0.6.1
github.com/cyberphone/json-canonicalization	v0.0.0-20231217050601-ba74d44ecf5f -> v0.0.0-20241213102144-19d51d7fe467
github.com/cyphar/filepath-securejoin	v0.2.4 -> v0.4.1
github.com/digitalocean/go-qemu	v0.0.0-20230711162256-2e3d0186973e -> v0.0.0-20250212194115-ee9b0668d242
github.com/docker/docker	v25.0.3+incompatible -> v28.3.3+incompatible
github.com/docker/docker-credential-helpers	v0.8.1 -> v0.9.3
github.com/fsnotify/fsnotify	v1.7.0 -> v1.9.0
github.com/fsouza/go-dockerclient	v1.10.1 -> v1.12.1
github.com/go-logr/logr	v1.4.1 -> v1.4.3
github.com/go-openapi/analysis	v0.21.4 -> v0.23.0
github.com/go-openapi/errors	v0.21.1 -> v0.22.0
github.com/go-openapi/jsonpointer	v0.19.6 -> v0.21.0
github.com/go-openapi/jsonreference	v0.20.2 -> v0.21.0
github.com/go-openapi/loads	v0.21.2 -> v0.22.0
github.com/go-openapi/runtime	v0.26.0 -> v0.28.0
github.com/go-openapi/spec	v0.20.9 -> v0.21.0
github.com/go-openapi/strfmt	v0.22.2 -> v0.23.0
github.com/go-openapi/swag	v0.22.10 -> v0.23.0
github.com/go-openapi/validate	v0.22.1 -> v0.24.0
github.com/godbus/dbus/v5	v5.1.1-0.20230522191255-76236955d466 -> v5.1.1-0.20241109141217-c266b19b28e9
github.com/golang/groupcache	v0.0.0-20210331224755-41bb18bfe9da -> v0.0.0-20241129210726-2c02b8208cf8
github.com/golang/protobuf	v1.5.3 -> v1.5.4
github.com/google/go-cmp	v0.6.0 -> v0.7.0
github.com/google/go-containerregistry	v0.19.0 -> v0.20.3
github.com/google/pprof	v0.0.0-20230323073829-e72429f035bd -> v0.0.0-20250403155104-27863c87afa6
github.com/gorilla/schema	v1.2.1 -> v1.4.1
github.com/klauspost/compress	v1.17.7 -> v1.18.0
github.com/klauspost/cpuid/v2	v2.2.8 -> v2.2.10
github.com/letsencrypt/boulder	v0.0.0-20230907030200-6d76a0f91e1e -> v0.0.0-20240620165639-de9c06129bec
github.com/lufia/plan9stats	v0.0.0-20211012122336-39d0f177ccd0 -> v0.0.0-20240909124753-873cd0166683
github.com/mattn/go-colorable	v0.1.13 -> v0.1.14
github.com/mattn/go-runewidth	v0.0.15 -> v0.0.16
github.com/mattn/go-sqlite3	v1.14.22 -> v1.14.28
github.com/moby/buildkit	v0.12.5 -> v0.23.2
github.com/moby/sys/mountinfo	v0.7.1 -> v0.7.2
github.com/moby/sys/sequential	v0.5.0 -> v0.6.0
github.com/moby/sys/user	v0.1.0 -> v0.4.0
github.com/opencontainers/image-spec	v1.1.0 -> v1.1.1
github.com/opencontainers/runc	v1.1.12 -> v1.3.0
github.com/opencontainers/runtime-spec	v1.2.0 -> v1.2.1
github.com/opencontainers/runtime-tools	v0.9.1-0.20230914150019-408c51e934dc -> v0.9.1-0.20250523060157-0ea5ed0382a2
github.com/opencontainers/selinux	v1.11.0 -> v1.12.0
github.com/openshift/imagebuilder	v1.2.6 -> v1.2.16
github.com/pkg/sftp	v1.13.6 -> v1.13.9
github.com/power-devops/perfstat	v0.0.0-20210106213030-5aafc221ea8c -> v0.0.0-20240221224432-82ca36839d55
github.com/proglottis/gpgme	v0.1.3 -> v0.1.4
github.com/secure-systems-lab/go-securesystemslib	v0.8.0 -> v0.9.0
github.com/sigstore/fulcio	v1.4.3 -> v1.6.6
github.com/sigstore/rekor	v1.2.2 -> v1.3.6
github.com/sigstore/sigstore	v1.8.2 -> v1.9.5
github.com/tchap/go-patricia/v2	v2.3.1 -> v2.3.3
github.com/tklauser/go-sysconf	v0.3.12 -> v0.3.14
github.com/tklauser/numcpus	v0.6.1 -> v0.9.0
github.com/ulikunitz/xz	v0.5.11 -> v0.5.15
github.com/vbatts/tar-split	v0.11.5 -> v0.12.1
github.com/vbauerster/mpb/v8	v8.7.2 -> v8.10.2
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.45.0 -> v0.60.0
go.opentelemetry.io/otel	v1.22.0 -> v1.35.0
go.opentelemetry.io/otel/metric	v1.22.0 -> v1.35.0
golang.org/x/exp	v0.0.0-20240222234643-814bf88cf225 -> v0.0.0-20250408133849-7e4ce0ab07d0
golang.org/x/mod	v0.17.0 -> v0.25.0
golang.org/x/net	v0.30.0 -> v0.42.0
golang.org/x/sync	v0.8.0 -> v0.16.0
golang.org/x/text	v0.19.0 -> v0.27.0
golang.org/x/time	v0.3.0 -> v0.11.0
golang.org/x/tools	v0.21.1-0.20240508182429-e35e4ccd0d2d -> v0.34.0
google.golang.org/genproto/googleapis/rpc	v0.0.0-20231212172506-995d672761c0 -> v0.0.0-20250313205543-e70fdf4c4cb4
google.golang.org/grpc	v1.61.0 -> v1.72.2
google.golang.org/protobuf	v1.35.1 -> v1.36.6
sigs.k8s.io/yaml	v1.4.0 -> v1.5.0
tags.cncf.io/container-device-interface	v0.6.2 -> v1.0.1

[bootc-bot]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

[cgwalters]

Yeah none of these CVEs apply to us either...

This whole thing is very much reinforcing my desire to use Rust for this project...