Configuration entries listed above for each entry type (Ansible variable, environment variable, and so on) have a low to high priority order.
+For example, a variable that is lower in the list will override a variable that is higher up.
+The entry types are also ordered by precedence from low to high priority order.
+For example, an ansible.cfg entry (further up in the list) is overwritten by an Ansible variable (further down in the list).
User specified via name or UID which is used to execute commands inside the container. If you specify the user via UID, you must set ANSIBLE_REMOTE_TMP to a path that exits inside the container and is writable by Ansible.
Configuration entries listed above for each entry type (Ansible variable, environment variable, and so on) have a low to high priority order.
+For example, a variable that is lower in the list will override a variable that is higher up.
+The entry types are also ordered by precedence from low to high priority order.
+For example, an ansible.cfg entry (further up in the list) is overwritten by an Ansible variable (further down in the list).
-name:Copy file "test.yml" on the host to the "apache" container's root folder
+containers.podman.podman_container_copy:
+src:test.yml
+dest:/
+container:apache
+-name:Copy file "test.yml" in the "apache" container's root folder to the playbook's folder
+containers.podman.podman_container_copy:
+src:/test.yml
+dest:./
+container:apache
+from_container:True
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_container_exec.
-name:Execute a command with workdir
+containers.podman.podman_container_exec:
+name:ubi8
+command:"catredhat-release"
+workdir:/etc
+
+-name:Execute a command with a list of args and environment variables
+containers.podman.podman_container_exec:
+name:test_container
+argv:
+-/bin/sh
+--c
+-echo $HELLO $BYE
+env:
+HELLO:hello world
+BYE:goodbye world
+
+-name:Execute command in background by using detach
+containers.podman.podman_container_exec:
+name:detach_container
+command:"catredhat-release"
+detach:true
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_container_info.
-name:Gather facts for all containers
+containers.podman.podman_container_info:
+
+-name:Gather facts on a specific container
+containers.podman.podman_container_info:
+name:web1
+
+-name:Gather facts on several containers
+containers.podman.podman_container_info:
+name:
+-redis
+-web1
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_container.
Add an annotation to the container. The format is key value, multiple times.
+
+
+
+
arch
+
string
+
+
Set the architecture for the container. Override the architecture, defaults to hosts, of the image to be pulled. For example, arm.
+
+
+
+
attach
+
list / elements=string
+
+
Attach to STDIN, STDOUT or STDERR. The default in Podman is false.
+
Choices:
+
+
"stdin"
+
"stdout"
+
"stderr"
+
+
+
+
+
authfile
+
path
+
+
Path of the authentication file. Default is ``${XDG_RUNTIME_DIR}/containers/auth.json`` (Not available for remote commands) You can also override the default path of the authentication file by setting the ``REGISTRY_AUTH_FILE`` environment variable. ``export REGISTRY_AUTH_FILE=path``
+
+
+
+
blkio_weight
+
integer
+
+
Block IO weight (relative weight) accepts a weight value between 10 and 1000
+
+
+
+
blkio_weight_device
+
dictionary
+
+
Block IO weight (relative device weight, format DEVICE_NAME[:]WEIGHT).
+
+
+
+
+
cap_add
+
aliases: capabilities
+
list / elements=string
+
+
List of capabilities to add to the container.
+
+
+
+
cap_drop
+
list / elements=string
+
+
List of capabilities to drop from the container.
+
+
+
+
cgroup_conf
+
dictionary
+
+
When running on cgroup v2, specify the cgroup file to write to and its value.
+
+
+
+
cgroup_parent
+
path
+
+
Path to cgroups under which the cgroup for the container will be created. If the path is not absolute, the path is considered to be relative to the cgroups path of the init process. Cgroups will be created if they do not already exist.
+
+
+
+
cgroupns
+
string
+
+
Path to cgroups under which the cgroup for the container will be created.
+
+
+
+
cgroups
+
string
+
+
Determines whether the container will create CGroups. Valid values are enabled and disabled, which the default being enabled. The disabled option will force the container to not create CGroups, and thus conflicts with CGroup options cgroupns and cgroup-parent.
+
+
+
+
chrootdirs
+
string
+
+
Path to a directory inside the container that is treated as a chroot directory.
+
+
+
+
cidfile
+
path
+
+
Write the container ID to the file
+
+
+
+
cmd_args
+
list / elements=string
+
+
Any additional command options you want to pass to podman command itself, for example --log-level=debug or --syslog. This is NOT command to run in container, but rather options for podman itself. For container command please use command option.
+
+
+
+
command
+
any
+
+
Override command of container. Can be a string or a list.
+
+
+
+
conmon_pidfile
+
path
+
+
Write the pid of the conmon process to a file. conmon runs in a separate process than Podman, so this is necessary when using systemd to restart Podman containers.
+
+
+
+
cpu_period
+
integer
+
+
Limit the CPU CFS (Completely Fair Scheduler) period
+
+
+
+
cpu_quota
+
integer
+
+
Limit the CPU CFS (Completely Fair Scheduler) quota
+
+
+
+
cpu_rt_period
+
integer
+
+
Limit the CPU real-time period in microseconds. Limit the container’s Real Time CPU usage. This flag tell the kernel to restrict the container’s Real Time CPU usage to the period you specify.
+
+
+
+
cpu_rt_runtime
+
integer
+
+
Limit the CPU real-time runtime in microseconds. This flag tells the kernel to limit the amount of time in a given CPU period Real Time tasks may consume.
+
+
+
+
cpu_shares
+
integer
+
+
CPU shares (relative weight)
+
+
+
+
cpus
+
string
+
+
Number of CPUs. The default is 0.0 which means no limit.
+
+
+
+
cpuset_cpus
+
string
+
+
CPUs in which to allow execution (0-3, 0,1)
+
+
+
+
cpuset_mems
+
string
+
+
Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on NUMA systems.
+
+
+
+
debug
+
boolean
+
+
Return additional information which can be helpful for investigations.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
decryption_key
+
string
+
+
The “key-passphrase” to be used for decryption of images. Key can point to keys and/or certificates.
+
+
+
+
delete_depend
+
boolean
+
+
Remove selected container and recursively remove all containers that depend on it. Applies to “delete” command.
+
Choices:
+
+
false
+
true
+
+
+
+
+
delete_time
+
string
+
+
Seconds to wait before forcibly stopping the container. Use -1 for infinite wait. Applies to “delete” command.
+
+
+
+
delete_volumes
+
boolean
+
+
Remove anonymous volumes associated with the container. This does not include named volumes created with podman volume create, or the –volume option of podman run and podman create.
+
Choices:
+
+
false
+
true
+
+
+
+
+
detach
+
boolean
+
+
Run container in detach mode
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
detach_keys
+
string
+
+
Override the key sequence for detaching a container. Format is a single character or ctrl-value
+
+
+
+
device
+
list / elements=string
+
+
Add a host device to the container. The format is <device-on-host>[:<device-on-container>][:<permissions>] (e.g. device /dev/sdc:/dev/xvdc:rwm)
+
+
+
+
device_cgroup_rule
+
string
+
+
Add a rule to the cgroup allowed devices list. The rule is expected to be in the format specified in the Linux kernel documentation admin-guide/cgroup-v1/devices.
+
+
+
+
device_read_bps
+
list / elements=string
+
+
Limit read rate (bytes per second) from a device (e.g. device-read-bps /dev/sda:1mb)
+
+
+
+
device_read_iops
+
list / elements=string
+
+
Limit read rate (IO per second) from a device (e.g. device-read-iops /dev/sda:1000)
+
+
+
+
device_write_bps
+
list / elements=string
+
+
Limit write rate (bytes per second) to a device (e.g. device-write-bps /dev/sda:1mb)
+
+
+
+
device_write_iops
+
list / elements=string
+
+
Limit write rate (IO per second) to a device (e.g. device-write-iops /dev/sda:1000)
+
+
+
+
+
dns
+
aliases: dns_servers
+
list / elements=string
+
+
Set custom DNS servers
+
+
+
+
+
dns_option
+
aliases: dns_opts
+
string
+
+
Set custom DNS options
+
+
+
+
+
dns_search
+
aliases: dns_search_domains
+
list / elements=string
+
+
Set custom DNS search domains (Use dns_search with ‘’ if you don’t wish to set the search domain)
+
+
+
+
entrypoint
+
string
+
+
Overwrite the default ENTRYPOINT of the image
+
+
+
+
env
+
dictionary
+
+
Set environment variables. This option allows you to specify arbitrary environment variables that are available for the process that will be launched inside of the container.
+
+
+
+
+
env_file
+
aliases: env_files
+
list / elements=path
+
+
Read in a line delimited file of environment variables. Doesn’t support idempotency. If users changes the file with environment variables it’s on them to recreate the container. The file must be present on the REMOTE machine where actual podman is running, not on the controller machine where Ansible is executing. If you need to copy the file from controller to remote machine, use the copy or slurp module.
+
+
+
+
env_host
+
boolean
+
+
Use all current host environment variables in container. Defaults to false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
env_merge
+
dictionary
+
+
Preprocess default environment variables for the containers
+
+
+
+
+
etc_hosts
+
aliases: add_hosts
+
dictionary
+
+
Dict of host-to-IP mappings, where each host name is a key in the dictionary. Each host name will be added to the container’s ``/etc/hosts`` file.
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
+
Default:"podman"
+
+
+
+
+
+
expose
+
aliases: exposed, exposed_ports
+
list / elements=string
+
+
Expose a port, or a range of ports (e.g. expose “3300-3310”) to set up port redirection on the host system.
+
+
+
+
force_delete
+
boolean
+
+
Force deletion of container when it’s being deleted.
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
+
force_restart
+
aliases: restart
+
boolean
+
+
Force restart of container.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
generate_systemd
+
dictionary
+
+
Generate systemd unit file for container.
+
Default:{}
+
+
+
+
after
+
list / elements=string
+
+
Add the systemd unit after (After=) option, that ordering dependencies between the list of dependencies and this service.
+
+
+
+
container_prefix
+
string
+
+
Set the systemd unit name prefix for containers. The default is “container”.
+
+
+
+
names
+
boolean
+
+
Use names of the containers for the start, stop, and description in the unit file. Default is true.
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
new
+
boolean
+
+
Create containers and pods when the unit is started instead of expecting them to exist. The default is “false”. Refer to podman-generate-systemd(1) for more information.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
no_header
+
boolean
+
+
Do not generate the header including meta data such as the Podman version and the timestamp. From podman version 3.1.0.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
path
+
string
+
+
Specify a path to the directory where unit files will be generated. Required for this option. If it doesn’t exist, the directory will be created.
+
+
+
+
pod_prefix
+
string
+
+
Set the systemd unit name prefix for pods. The default is “pod”.
+
+
+
+
requires
+
list / elements=string
+
+
Set the systemd unit requires (Requires=) option. Similar to wants, but declares a stronger requirement dependency.
+
+
+
+
restart_policy
+
string
+
+
Specify a restart policy for the service. The restart-policy must be one of “no”, “on-success”, “on-failure”, “on-abnormal”, “on-watchdog”, “on-abort”, or “always”. The default policy is “on-failure”.
+
Choices:
+
+
"no"
+
"on-success"
+
"on-failure"
+
"on-abnormal"
+
"on-watchdog"
+
"on-abort"
+
"always"
+
+
+
+
+
restart_sec
+
integer
+
+
Set the systemd service restartsec value.
+
+
+
+
separator
+
string
+
+
Set the systemd unit name separator between the name/id of a container/pod and the prefix. The default is “-” (dash).
+
+
+
+
start_timeout
+
integer
+
+
Override the default start timeout for the container with the given value.
+
+
+
+
+
stop_timeout
+
aliases: time
+
integer
+
+
Override the default stop timeout for the container with the given value. Called `time` before version 4.
+
+
+
+
wants
+
list / elements=string
+
+
Add the systemd unit wants (Wants=) option, that this service is (weak) dependent on.
+
+
+
+
gidmap
+
list / elements=string
+
+
Run the container in a new user namespace using the supplied mapping.
+
+
+
+
gpus
+
string
+
+
GPU devices to add to the container.
+
+
+
+
+
group_add
+
aliases: groups
+
list / elements=string
+
+
Add additional groups to run as
+
+
+
+
group_entry
+
string
+
+
Customize the entry that is written to the /etc/group file within the container when –user is used.
+
+
+
+
health_startup_cmd
+
string
+
+
Set a startup healthcheck command for a container.
+
+
+
+
health_startup_interval
+
string
+
+
Set an interval for the startup healthcheck.
+
+
+
+
health_startup_retries
+
integer
+
+
The number of attempts allowed before the startup healthcheck restarts the container. If set to 0, the container is never restarted. The default is 0.
+
+
+
+
health_startup_success
+
integer
+
+
The number of successful runs required before the startup healthcheck succeeds and the regular healthcheck begins. A value of 0 means that any success begins the regular healthcheck. The default is 0.
+
+
+
+
health_startup_timeout
+
string
+
+
The maximum time a startup healthcheck command has to complete before it is marked as failed.
+
+
+
+
+
healthcheck
+
aliases: health_cmd
+
string
+
+
Set or alter a healthcheck command for a container.
+
+
+
+
+
healthcheck_failure_action
+
aliases: health_on_failure
+
string
+
+
The action to be taken when the container is considered unhealthy. The action must be one of “none”, “kill”, “restart”, or “stop”. The default policy is “none”.
+
Choices:
+
+
"none"
+
"kill"
+
"restart"
+
"stop"
+
+
+
+
+
+
healthcheck_interval
+
aliases: health_interval
+
string
+
+
Set an interval for the healthchecks (a value of disable results in no automatic timer setup) (default “30s”)
+
+
+
+
+
healthcheck_retries
+
aliases: health_retries
+
integer
+
+
The number of retries allowed before a healthcheck is considered to be unhealthy. The default value is 3.
+
+
+
+
+
healthcheck_start_period
+
aliases: health_start_period
+
string
+
+
The initialization time needed for a container to bootstrap. The value can be expressed in time format like 2m3s. The default value is 0s
+
+
+
+
+
healthcheck_timeout
+
aliases: health_timeout
+
string
+
+
The maximum time allowed to complete the healthcheck before an interval is considered failed. Like start-period, the value can be expressed in a time format such as 1m22s. The default value is 30s
+
+
+
+
hooks_dir
+
list / elements=string
+
+
Each .json file in the path configures a hook for Podman containers. For more details on the syntax of the JSON files and the semantics of hook injection, see oci-hooks(5). Can be set multiple times.
+
+
+
+
hostname
+
string
+
+
Container host name. Sets the container host name that is available inside the container.
+
+
+
+
hostuser
+
string
+
+
Add a user account to /etc/passwd from the host to the container. The Username or UID must exist on the host system.
+
+
+
+
http_proxy
+
boolean
+
+
By default proxy environment variables are passed into the container if set for the podman process. This can be disabled by setting the http_proxy option to false. The environment variables passed in include http_proxy, https_proxy, ftp_proxy, no_proxy, and also the upper case versions of those. Defaults to true
+
Choices:
+
+
false
+
true
+
+
+
+
+
image
+
string
+
+
Repository path (or image name) and tag used to create the container. If an image is not found, the image will be pulled from the registry. If no tag is included, latest will be used.
+
Can also be an image ID. If this is the case, the image is assumed to be available locally.
+
+
+
+
image_strict
+
boolean
+
+
Whether to compare images in idempotency by taking into account a full name with registry and namespaces.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
image_volume
+
string
+
+
Tells podman how to handle the builtin image volumes. The options are bind, tmpfs, or ignore (default bind)
+
Choices:
+
+
"bind"
+
"tmpfs"
+
"ignore"
+
+
+
+
+
init
+
boolean
+
+
Run an init inside the container that forwards signals and reaps processes. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
init_ctr
+
string
+
+
(Pods only). When using pods, create an init style container, which is run after the infra container is started but before regular pod containers are started.
+
Choices:
+
+
"once"
+
"always"
+
+
+
+
+
init_path
+
string
+
+
Path to the container-init binary.
+
+
+
+
interactive
+
boolean
+
+
Keep STDIN open even if not attached. The default is false. When set to true, keep stdin open even if not attached. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
ip
+
string
+
+
Specify a static IP address for the container, for example ‘10.88.64.128’. Can only be used if no additional CNI networks to join were specified via ‘network:’, and if the container is not joining another container’s network namespace via ‘network container:<name|id>’. The address must be within the default CNI network’s pool (default 10.88.0.0/16).
+
+
+
+
ip6
+
string
+
+
Specify a static IPv6 address for the container
+
+
+
+
+
ipc
+
aliases: ipc_mode
+
string
+
+
Default is to create a private IPC namespace (POSIX SysV IPC) for the container
+
+
+
+
kernel_memory
+
string
+
+
Kernel memory limit (format <number>[<unit>], where unit = b, k, m or g) Note - idempotency is supported for integers only.
+
+
+
+
+
label
+
aliases: labels
+
dictionary
+
+
Add metadata to a container, pass dictionary of label names and values
+
+
+
+
label_file
+
string
+
+
Read in a line delimited file of labels
+
+
+
+
log_driver
+
string
+
+
Logging driver. Used to set the log driver for the container. For example log_driver “k8s-file”.
Logging driver specific options. Used to set the path to the container log file.
+
+
+
+
+
max_size
+
string
+
+
Specify a max size of the log file (e.g 10mb).
+
+
+
+
+
path
+
string
+
+
Specify a path to the log file (e.g. /var/log/container/mycontainer.json).
+
+
+
+
+
tag
+
string
+
+
Specify a custom log tag for the container.
+
+
+
+
mac_address
+
string
+
+
Specify a MAC address for the container, for example ‘92:d0:c6:0a:29:33’. Don’t forget that it must be unique within one Ethernet network.
+
+
+
+
memory
+
string
+
+
Memory limit (format 10k, where unit = b, k, m or g) Note - idempotency is supported for integers only.
+
+
+
+
memory_reservation
+
string
+
+
Memory soft limit (format 100m, where unit = b, k, m or g) Note - idempotency is supported for integers only.
+
+
+
+
memory_swap
+
string
+
+
A limit value equal to memory plus swap. Must be used with the -m (–memory) flag. The swap LIMIT should always be larger than -m (–memory) value. By default, the swap LIMIT will be set to double the value of –memory Note - idempotency is supported for integers only.
+
+
+
+
memory_swappiness
+
integer
+
+
Tune a container’s memory swappiness behavior. Accepts an integer between 0 and 100.
+
+
+
+
+
mount
+
aliases: mounts
+
list / elements=string
+
+
Attach a filesystem mount to the container. bind or tmpfs For example mount “type=bind,source=/path/on/host,destination=/path/in/container”
+
+
+
+
name
+
string / required
+
+
Name of the container
+
+
+
+
+
+
network
+
aliases: net, network_mode
+
list / elements=string
+
+
Set the Network mode for the container.
+
bridge - create a network stack on the default bridge.
+
none - no networking.
+
container:<name|id> - reuse another container’s network stack.
+
host - use the podman host network stack.
+
<network-name>|<network-id> - connect to a user-defined network.
+
ns:<path> - path to a network namespace to join.
+
slirp4netns - use slirp4netns to create a user network stack. This is the default for rootless containers.
+
+
+
+
+
network_aliases
+
aliases: network_alias
+
list / elements=string
+
+
Add network-scoped alias for the container. A container will only have access to aliases on the first network that it joins. This is a limitation that will be removed in a later release.
+
+
+
+
no_healthcheck
+
boolean
+
+
Disable any defined healthchecks for container.
+
Choices:
+
+
false
+
true
+
+
+
+
+
no_hosts
+
boolean
+
+
Do not create /etc/hosts for the container Default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
oom_kill_disable
+
boolean
+
+
Whether to disable OOM Killer for the container or not. Default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
oom_score_adj
+
integer
+
+
Tune the host’s OOM preferences for containers (accepts -1000 to 1000)
+
+
+
+
os
+
string
+
+
Override the OS, defaults to hosts, of the image to be pulled. For example, windows.
+
+
+
+
passwd
+
boolean
+
+
Allow Podman to add entries to /etc/passwd and /etc/group when used in conjunction with the –user option. This is used to override the Podman provided user setup in favor of entrypoint configurations such as libnss-extrausers.
+
Choices:
+
+
false
+
true
+
+
+
+
+
passwd_entry
+
string
+
+
Customize the entry that is written to the /etc/passwd file within the container when –passwd is used.
+
+
+
+
personality
+
string
+
+
Personality sets the execution domain via Linux personality(2).
+
+
+
+
+
pid
+
aliases: pid_mode
+
string
+
+
Set the PID mode for the container
+
+
+
+
pid_file
+
path
+
+
When the pidfile location is specified, the container process’ PID is written to the pidfile.
+
+
+
+
pids_limit
+
string
+
+
Tune the container’s PIDs limit. Set -1 to have unlimited PIDs for the container.
+
+
+
+
platform
+
string
+
+
Specify the platform for selecting the image.
+
+
+
+
pod
+
string
+
+
Run container in an existing pod. If you want podman to make the pod for you, prefix the pod name with “new:”
+
+
+
+
pod_id_file
+
path
+
+
Run container in an existing pod and read the pod’s ID from the specified file. When a container is run within a pod which has an infra-container, the infra-container starts first.
+
+
+
+
podman_socket
+
string
+
+
Unix socket address for API connection. If API is not available, the module will fail.
+
+
+
+
preserve_fd
+
list / elements=string
+
+
Pass down to the process the additional file descriptors specified in the comma separated list.
+
+
+
+
preserve_fds
+
string
+
+
Pass down to the process N additional file descriptors (in addition to 0, 1, 2). The total FDs are 3\+N.
+
+
+
+
privileged
+
boolean
+
+
Give extended privileges to this container. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
+
+
+
publish
+
aliases: ports, published, published_ports
+
list / elements=string
+
+
Publish a container’s port, or range of ports, to the host. Format - ip:hostPort:containerPort | ip::containerPort | hostPort:containerPort | containerPort In case of only containerPort is set, the hostPort will chosen randomly by Podman.
+
+
+
+
publish_all
+
boolean
+
+
Publish all exposed ports to random ports on the host interfaces. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
pull
+
string
+
+
Pull image policy. The default is ‘missing’.
+
Choices:
+
+
"missing"
+
"always"
+
"never"
+
"newer"
+
+
+
+
+
quadlet_dir
+
path
+
+
Path to the directory to write quadlet file in. By default, it will be set as /etc/containers/systemd/ for root user, ~/.config/containers/systemd/ for non-root users.
+
+
+
+
quadlet_file_mode
+
any
+
+
The permissions of the quadlet file.
+
The quadlet_file_mode can be specied as octal numbers or as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r). For octal numbers format, you must either add a leading zero so that Ansible’s YAML parser knows it is an octal number (like 0644 or 01777) or quote it (like '644' or '1777') so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results.
+
If quadlet_file_mode is not specified and the quadlet file does not exist, the default '0640' mask will be used when setting the mode for the newly created file.
+
If quadlet_file_mode is not specified and the quadlet file does exist, the mode of the existing file will be used.
+
Specifying quadlet_file_mode is the best way to ensure files are created with the correct permissions.
+
+
+
+
quadlet_filename
+
string
+
+
Name of quadlet file to write. By default it takes name value.
+
+
+
+
quadlet_options
+
list / elements=string
+
+
Options for the quadlet file. Provide missing in usual container args options as a list of lines to add.
+
+
+
+
rdt_class
+
string
+
+
Rdt-class sets the class of service (CLOS or COS) for the container to run in. Requires root.
+
+
+
+
read_only
+
boolean
+
+
Mount the container’s root filesystem as read only. Default is false
+
Choices:
+
+
false
+
true
+
+
+
+
+
read_only_tmpfs
+
boolean
+
+
If container is running in –read-only mode, then mount a read-write tmpfs on /run, /tmp, and /var/tmp. The default is true
+
Choices:
+
+
false
+
true
+
+
+
+
+
recreate
+
boolean
+
+
Use with present and started states to force the re-creation of an existing container.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
requires
+
list / elements=string
+
+
Specify one or more requirements. A requirement is a dependency container that will be started before this container. Containers can be specified by name or ID.
+
+
+
+
restart_policy
+
string
+
+
Restart policy to follow when containers exit. Restart policy will not take effect if a container is stopped via the podman kill or podman stop commands. Valid values are * no - Do not restart containers on exit * on-failure[:max_retries] - Restart containers when they exit with a non-0 exit code, retrying indefinitely or until the optional max_retries count is hit * always - Restart containers when they exit, regardless of status, retrying indefinitely
+
+
+
+
restart_time
+
string
+
+
Seconds to wait before forcibly stopping the container when restarting. Use -1 for infinite wait. Applies to “restarted” status.
+
+
+
+
retry
+
integer
+
+
Number of times to retry pulling or pushing images between the registry and local storage in case of failure. Default is 3.
+
+
+
+
retry_delay
+
string
+
+
Duration of delay between retry attempts when pulling or pushing images between the registry and local storage in case of failure.
+
+
+
+
+
+
rm
+
aliases: remove, auto_remove
+
boolean
+
+
Automatically remove the container when it exits. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
rmi
+
boolean
+
+
After exit of the container, remove the image unless another container is using it. Implies –rm on the new container. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
rootfs
+
boolean
+
+
If true, the first argument refers to an exploded container on the file system. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
sdnotify
+
string
+
+
Determines how to use the NOTIFY_SOCKET, as passed with systemd and Type=notify. Can be container, conmon, ignore. For quadlets it can also be healthy to use the built in health checks, see documentation for more details.
+
+
+
+
seccomp_policy
+
string
+
+
Specify the policy to select the seccomp profile.
+
+
+
+
secrets
+
list / elements=string
+
+
Add the named secrets into the container. The format is secret[,opt=opt...], see documentation for more details.
+
+
+
+
security_opt
+
list / elements=string
+
+
Security Options. For example security_opt “seccomp=unconfined”
+
+
+
+
shm_size
+
string
+
+
Size of /dev/shm. The format is <number><unit>. number must be greater than 0. Unit is optional and can be b (bytes), k (kilobytes), m(megabytes), or g (gigabytes). If you omit the unit, the system uses bytes. If you omit the size entirely, the system uses 64m
+
+
+
+
shm_size_systemd
+
string
+
+
Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp.
+
+
+
+
sig_proxy
+
boolean
+
+
Proxy signals sent to the podman run command to the container process. SIGCHLD, SIGSTOP, and SIGKILL are not proxied. The default is true.
+
Choices:
+
+
false
+
true
+
+
+
+
+
state
+
string
+
+
absent - A container matching the specified name will be stopped and removed.
+
present - Asserts the existence of a container matching the name and any provided configuration parameters. If no container matches the name, a container will be created. If a container matches the name but the provided configuration does not match, the container will be updated, if it can be. If it cannot be updated, it will be removed and re-created with the requested config. Image version will be taken into account when comparing configuration. Use the recreate option to force the re-creation of the matching container.
+
started - Asserts there is a running container matching the name and any provided configuration. If no container matches the name, a container will be created and started. Use recreate to always re-create a matching container, even if it is running. Use force_restart to force a matching container to be stopped and restarted.
+
stopped - Asserts that the container is first present, and then if the container is running moves it to a stopped state.
+
created - Asserts that the container exists with given configuration. If container doesn’t exist, the module creates it and leaves it in ‘created’ state. If configuration doesn’t match or ‘recreate’ option is set, the container will be recreated
+
quadlet - Write a quadlet file with the specified configuration.
+
Choices:
+
+
"absent"
+
"present"
+
"stopped"
+
"started"← (default)
+
"created"
+
"quadlet"
+
+
+
+
+
stop_signal
+
integer
+
+
Signal to stop a container. Default is SIGTERM.
+
+
+
+
stop_time
+
string
+
+
Seconds to wait before forcibly stopping the container. Use -1 for infinite wait. Applies to “stopped” status.
+
+
+
+
stop_timeout
+
integer
+
+
Timeout (in seconds) to stop a container. Default is 10.
+
+
+
+
subgidname
+
string
+
+
Run the container in a new user namespace using the map with ‘name’ in the /etc/subgid file.
+
+
+
+
subuidname
+
string
+
+
Run the container in a new user namespace using the map with ‘name’ in the /etc/subuid file.
+
+
+
+
sysctl
+
dictionary
+
+
Configure namespaced kernel parameters at runtime
+
+
+
+
systemd
+
string
+
+
Run container in systemd mode. The default is true.
+
+
+
+
timeout
+
integer
+
+
Maximum time (in seconds) a container is allowed to run before conmon sends it the kill signal. By default containers run until they exit or are stopped by “podman stop”.
+
+
+
+
timezone
+
string
+
+
Set timezone in container. This flag takes area-based timezones, GMT time, as well as local, which sets the timezone in the container to match the host machine. See /usr/share/zoneinfo/ for valid timezones. Remote connections use local containers.conf for defaults.
+
+
+
+
tls_verify
+
boolean
+
+
Require HTTPS and verify certificates when pulling images.
+
Choices:
+
+
false
+
true
+
+
+
+
+
tmpfs
+
dictionary
+
+
Create a tmpfs mount. For example tmpfs “/tmp” “rw,size=787448k,mode=1777”
+
+
+
+
tty
+
boolean
+
+
Allocate a pseudo-TTY. The default is false.
+
Choices:
+
+
false
+
true
+
+
+
+
+
uidmap
+
list / elements=string
+
+
Run the container in a new user namespace using the supplied mapping.
+
+
+
+
+
ulimit
+
aliases: ulimits
+
list / elements=string
+
+
Ulimit options
+
+
+
+
umask
+
string
+
+
Set the umask inside the container. Defaults to 0022. Remote connections use local containers.conf for defaults.
+
+
+
+
unsetenv
+
list / elements=string
+
+
Unset default environment variables for the container.
+
+
+
+
unsetenv_all
+
boolean
+
+
Unset all default environment variables for the container.
+
Choices:
+
+
false
+
true
+
+
+
+
+
user
+
string
+
+
Sets the username or UID used and optionally the groupname or GID for the specified command.
+
+
+
+
+
userns
+
aliases: userns_mode
+
string
+
+
Set the user namespace mode for the container. It defaults to the PODMAN_USERNS environment variable. An empty value means user namespaces are disabled.
+
+
+
+
uts
+
string
+
+
Set the UTS mode for the container
+
+
+
+
variant
+
string
+
+
Use VARIANT instead of the default architecture variant of the container image.
+
+
+
+
+
volume
+
aliases: volumes
+
list / elements=string
+
+
Create a bind mount. If you specify, volume /HOST-DIR:/CONTAINER-DIR, podman bind mounts /HOST-DIR in the host to /CONTAINER-DIR in the podman container.
+
+
+
+
volumes_from
+
list / elements=string
+
+
Mount volumes from the specified container(s).
+
+
+
+
+
workdir
+
aliases: working_dir
+
string
+
+
Working directory inside the container. The default working directory for running binaries within a container is the root directory (/).
Common return values are documented here, the following are the fields unique to this module:
+
+
+
Key
+
Description
+
+
+
+
+
container
+
dictionary
+
+
Facts representing the current state of the container. Matches the podman inspection output.
+
Note that facts are part of the registered vars since Ansible 2.8. For compatibility reasons, the facts are also accessible directly as podman_container. Note that the returned fact will be removed in Ansible 2.12.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_containers.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_export.
# What modules does for example
+-containers.podman.podman_export:
+dest:/path/to/tar/file
+container:container-name
+-containers.podman.podman_export:
+dest:/path/to/tar/file
+volume:volume-name
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_generate_systemd.
# Example of creating a container and systemd unit file.
+# When using podman_generate_systemd with new:true then
+# the container needs rm:true for idempotence.
+-name:Create postgres container
+containers.podman.podman_container:
+name:postgres
+image:docker.io/library/postgres:latest
+rm:true
+state:created
+
+-name:Generate systemd unit file for postgres container
+containers.podman.podman_generate_systemd:
+name:postgres
+new:true
+no_header:true
+dest:/etc/systemd/system
+
+-name:Ensure postgres container is started and enabled
+ansible.builtin.systemd:
+name:container-postgres
+daemon_reload:true
+state:started
+enabled:true
+
+
+# Example of creating a container and integrate it into systemd
+-name:A postgres container must exist, stopped
+containers.podman.podman_container:
+name:postgres_local
+image:docker.io/library/postgres:latest
+state:stopped
+
+-name:Systemd unit files for postgres container must exist
+containers.podman.podman_generate_systemd:
+name:postgres_local
+dest:~/.config/systemd/user/
+
+-name:Postgres container must be started and enabled on systemd
+ansible.builtin.systemd:
+name:container-postgres_local
+scope:user
+daemon_reload:true
+state:started
+enabled:true
+
+
+# Generate the unit files, but store them on an Ansible variable
+# instead of writing them on target host
+-name:Systemd unit files for postgres container must be generated
+containers.podman.podman_generate_systemd:
+name:postgres_local
+register:postgres_local_systemd_unit
+
+# Generate the unit files with environment variables sets
+-name:Systemd unit files for postgres container must be generated
+containers.podman.podman_generate_systemd:
+name:postgres_local
+env:
+POSTGRES_USER:my_app
+POSTGRES_PASSWORD:example
+register:postgres_local_systemd_unit
+
-name:Gather info for all images
+containers.podman.podman_image_info:
+
+-name:Gather info on a specific image
+containers.podman.podman_image_info:
+name:nginx
+
+-name:Gather info on several images
+containers.podman.podman_image_info:
+name:
+-redis
+-quay.io/bitnami/wildfly
+
Path to file containing authorization credentials to the remote registry.
+
+
+
+
+
+
build
+
aliases: build_args, buildargs
+
dictionary
+
+
Arguments that control image build.
+
Default:{}
+
+
+
+
+
+
annotation
+
dictionary
+
+
Dictionary of key=value pairs to add to the image. Only works with OCI images. Ignored for Docker containers.
+
+
+
+
+
+
cache
+
boolean
+
+
Whether or not to use cached layers when building an image
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
+
+
container_file
+
string
+
+
Content of the Containerfile to use for building the image. Mutually exclusive with the file option which is path to the existing Containerfile.
+
+
+
+
+
+
extra_args
+
string
+
+
Extra args to pass to build, if executed. Does not idempotently check for new build args.
+
+
+
+
+
+
file
+
path
+
+
Path to the Containerfile if it is not in the build context directory. Mutually exclusive with the container_file option.
+
+
+
+
+
+
force_rm
+
boolean
+
+
Always remove intermediate containers after a build, even if the build is unsuccessful.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
+
+
format
+
string
+
+
Format of the built image.
+
Choices:
+
+
"docker"
+
"oci"← (default)
+
+
+
+
+
+
+
rm
+
boolean
+
+
Remove intermediate containers after a successful build
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
+
+
target
+
string
+
+
Specify the target build stage to build.
+
+
+
+
+
+
volume
+
list / elements=string
+
+
Specify multiple volume / mount options to mount one or more mounts to a container.
+
+
+
+
ca_cert_dir
+
path
+
+
Path to directory containing TLS certificates and keys to use.
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman.
+
Default:"podman"
+
+
+
+
force
+
boolean
+
+
Whether or not to force push or pull an image.
+
When building, force the build even if the image already exists.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
name
+
string / required
+
+
Name of the image to pull, push, or delete. It may contain a tag using the format image:tag.
+
+
+
+
password
+
string
+
+
Password to use when authenticating to remote registries.
+
+
+
+
path
+
string
+
+
Path to the build context directory.
+
+
+
+
pull
+
boolean
+
+
Whether or not to pull the image.
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
pull_extra_args
+
string
+
+
Extra arguments to pass to the pull command.
+
+
+
+
push
+
boolean
+
+
Whether or not to push an image.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
push_args
+
dictionary
+
+
Arguments that control pushing images.
+
Default:{}
+
+
+
+
compress
+
boolean
+
+
Compress tarball image layers when pushing to a directory using the ‘dir’ transport.
+
Choices:
+
+
false
+
true
+
+
+
+
+
+
dest
+
aliases: destination
+
string
+
+
Path or URL where image will be pushed.
+
+
+
+
extra_args
+
string
+
+
Extra args to pass to push, if executed. Does not idempotently check for new push args.
+
+
+
+
format
+
string
+
+
Manifest type to use when pushing an image using the ‘dir’ transport (default is manifest type of source)
+
Choices:
+
+
"oci"
+
"v2s1"
+
"v2s2"
+
+
+
+
+
remove_signatures
+
boolean
+
+
Discard any pre-existing signatures in the image
+
Choices:
+
+
false
+
true
+
+
+
+
+
sign_by
+
string
+
+
Path to a key file to use to sign the image.
+
+
+
+
ssh
+
string
+
+
SSH options to use when pushing images with SCP transport.
+
+
+
+
transport
+
string
+
+
Transport to use when pushing in image. If no transport is set, will attempt to push to a remote registry
+
Choices:
+
+
"dir"
+
"docker-archive"
+
"docker-daemon"
+
"oci-archive"
+
"ostree"
+
"docker"
+
"scp"
+
+
+
+
+
quadlet_dir
+
path
+
+
Path to the directory to write quadlet file in. By default, it will be set as /etc/containers/systemd/ for root user, ~/.config/containers/systemd/ for non-root users.
+
+
+
+
quadlet_file_mode
+
any
+
+
The permissions of the quadlet file.
+
The quadlet_file_mode can be specied as octal numbers or as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r). For octal numbers format, you must either add a leading zero so that Ansible’s YAML parser knows it is an octal number (like 0644 or 01777) or quote it (like '644' or '1777') so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results.
+
If quadlet_file_mode is not specified and the quadlet file does not exist, the default '0640' mask will be used when setting the mode for the newly created file.
+
If quadlet_file_mode is not specified and the quadlet file does exist, the mode of the existing file will be used.
+
Specifying quadlet_file_mode is the best way to ensure files are created with the correct permissions.
+
+
+
+
quadlet_filename
+
string
+
+
Name of quadlet file to write. By default it takes image name without prefixes and tags.
+
+
+
+
quadlet_options
+
list / elements=string
+
+
Options for the quadlet file. Provide missing in usual network args options as a list of lines to add.
+
+
+
+
state
+
string
+
+
Whether an image should be present, absent, or built.
+
Choices:
+
+
"present"← (default)
+
"absent"
+
"build"
+
"quadlet"
+
+
+
+
+
tag
+
string
+
+
Tag of the image to pull, push, or delete.
+
Default:"latest"
+
+
+
+
username
+
string
+
+
username to use when authenticating to remote registries.
+
+
+
+
+
+
validate_certs
+
aliases: tlsverify, tls_verify
+
boolean
+
+
Require HTTPS and validate certificates when pulling or pushing. Also used during build if a pull or push is necessary.
-name:Pull an image
+containers.podman.podman_image:
+name:quay.io/bitnami/wildfly
+
+-name:Remove an image
+containers.podman.podman_image:
+name:quay.io/bitnami/wildfly
+state:absent
+
+-name:Remove an image with image id
+containers.podman.podman_image:
+name:0e901e68141f
+state:absent
+
+-name:Pull a specific version of an image
+containers.podman.podman_image:
+name:redis
+tag:4
+
+-name:Build a basic OCI image
+containers.podman.podman_image:
+name:nginx
+path:/path/to/build/dir
+
+-name:Build a basic OCI image with advanced parameters
+containers.podman.podman_image:
+name:nginx
+path:/path/to/build/dir
+build:
+cache:no
+force_rm:true
+format:oci
+annotation:
+app:nginx
+function:proxy
+info:Load balancer for my cool app
+extra_args:"--build-argKEY=value"
+
+-name:Build a Docker formatted image
+containers.podman.podman_image:
+name:nginx
+path:/path/to/build/dir
+build:
+format:docker
+
+-name:Build and push an image using existing credentials
+containers.podman.podman_image:
+name:nginx
+path:/path/to/build/dir
+push:true
+push_args:
+dest:quay.io/acme
+
+-name:Build and push an image using an auth file
+containers.podman.podman_image:
+name:nginx
+push:true
+auth_file:/etc/containers/auth.json
+push_args:
+dest:quay.io/acme
+
+-name:Build and push an image using username and password
+containers.podman.podman_image:
+name:nginx
+push:true
+username:bugs
+password:"{{vault_registry_password}}"
+push_args:
+dest:quay.io/acme
+
+-name:Build and push an image to multiple registries
+containers.podman.podman_image:
+name:"{{item}}"
+path:/path/to/build/dir
+push:true
+auth_file:/etc/containers/auth.json
+loop:
+-quay.io/acme/nginx
+-docker.io/acme/nginx
+
+-name:Build and push an image to multiple registries with separate parameters
+containers.podman.podman_image:
+name:"{{item.name}}"
+tag:"{{item.tag}}"
+path:/path/to/build/dir
+push:true
+auth_file:/etc/containers/auth.json
+push_args:
+dest:"{{item.dest}}"
+loop:
+-name:nginx
+tag:4
+dest:docker.io/acme
+
+-name:nginx
+tag:3
+dest:docker.io/acme
+
+-name:Push image to a remote host via scp transport
+containers.podman.podman_image:
+name:testimage
+pull:false
+push:true
+push_args:
+dest:user@server
+transport:scp
+
+-name:Pull an image for a specific CPU architecture
+containers.podman.podman_image:
+name:nginx
+arch:amd64
+
+-name:Build a container from file inline
+containers.podman.podman_image:
+name:mycustom_image
+state:build
+build:
+container_file:|-
+FROM alpine:latest
+CMD echo "Hello, World!"
+
+-name:Create a quadlet file for an image
+containers.podman.podman_image:
+name:docker.io/library/alpine:latest
+state:quadlet
+quadlet_dir:/etc/containers/systemd
+quadlet_filename:alpine-latest
+quadlet_file_mode:'0640'
+quadlet_options:
+-Variant=arm/v7
+-|
+[Install]
+WantedBy=default.target
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_import.
# What modules does for example
+-containers.podman.podman_import:
+src:/path/to/tar/file
+change:
+-"CMD":/bin/bash
+-"User":root
+commit_message:"Importingimage"
+-containers.podman.podman_import:
+src:/path/to/tar/file
+volume:myvolume
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_load.
podman load loads an image from either an oci-archive or a docker-archive stored on the local machine into container storage. podman load is used for loading from the archive generated by podman save, that includes the image parent layers.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_login_info.
Path of the authentication file. Default is ``${XDG_RUNTIME_DIR}/containers/auth.json`` (Not available for remote commands) You can also override the default path of the authentication file by setting the ``REGISTRY_AUTH_FILE`` environment variable. ``export REGISTRY_AUTH_FILE=path``
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
-name:Return the logged-in user for docker hub registry
+containers.podman.podman_login_info:
+registry:docker.io
+
+-name:Return the logged-in user for quay.io registry
+containers.podman.podman_login_info:
+registry:quay.io
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_login.
Login to a container registry server using the podman login command If the registry is not specified, the first registry under `[registries.search]` from `registries.conf `will be used. The path of the authentication file can be overridden by the user by setting the `authfile` flag. The default path used is `${XDG_RUNTIME_DIR}/containers/auth.json`.
Path of the authentication file. Default is ``${XDG_RUNTIME_DIR}/containers/auth.json`` You can also override the default path of the authentication file by setting the ``REGISTRY_AUTH_FILE`` environment variable. ``export REGISTRY_AUTH_FILE=path``
+
+
+
+
certdir
+
path
+
+
Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. Default certificates directory is /etc/containers/certs.d.
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
+
Default:"podman"
+
+
+
+
password
+
string
+
+
Password for the registry server.
+
+
+
+
registry
+
string
+
+
Registry server. If the registry is not specified, the first registry under `[registries.search]` from `registries.conf` will be used.
+
+
+
+
secret
+
string
+
+
Name of an existing podman secret to use for authentication to target registry
+
+
+
+
tlsverify
+
boolean
+
+
Require HTTPS and verify certificates when contacting registries. If explicitly set to true, then TLS verification will be used. If set to false, then TLS verification will not be used. If not specified, TLS verification will be used unless the target registry is listed as an insecure registry in registries.conf.
-name:Login to default registry and create ${XDG_RUNTIME_DIR}/containers/auth.json
+containers.podman.podman_login:
+username:user
+password:'p4ssw0rd'
+
+-name:Login to quay.io and create ${XDG_RUNTIME_DIR}/containers/auth.json
+containers.podman.podman_login:
+username:user
+password:'p4ssw0rd'
+registry:quay.io
+
+-name:Login to quay.io using existing secret called password
+containers.podman.podman_login:
+username:user
+secret:password
+registry:quay.io
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_logout.
Log out of a container registry server using the podman logout command by deleting the cached credentials stored in the `auth.json` file. If the registry is not specified, the first registry under `[registries.search]` from `registries.conf `will be used. The path of the authentication file can be overridden by the user by setting the `authfile` flag. The default path used is `${XDG_RUNTIME_DIR}/containers/auth.json`. All the cached credentials can be removed by setting the `all` flag. Warning - podman will use credentials in `${HOME}/.docker/config.json` to authenticate in case they are not found in the default `authfile`. However, the logout command will only removed credentials in the `authfile` specified.
Remove the cached credentials for all registries in the auth file.
+
Choices:
+
+
false
+
true
+
+
+
+
+
authfile
+
path
+
+
Path of the authentication file. Default is ``${XDG_RUNTIME_DIR}/containers/auth.json`` You can also override the default path of the authentication file by setting the ``REGISTRY_AUTH_FILE`` environment variable. ``export REGISTRY_AUTH_FILE=path``
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
+
Default:"podman"
+
+
+
+
ignore_docker_credentials
+
boolean
+
+
Credentials created using other tools such as `docker login` are not removed unless the corresponding `authfile` is explicitly specified. Since podman also uses existing credentials in these files by default (for docker e.g. `${HOME}/.docker/config.json`), module execution will fail if a docker login exists for the registry specified in any `authfile` is used by podman. This can be ignored by setting `ignore_docker_credentials` to `true` - the credentials will be kept and `changed` will be false. This option cannot be used together with `all` since in this case podman will not check for existing `authfiles` created by other tools.
+
Choices:
+
+
false
+
true
+
+
+
+
+
registry
+
string
+
+
Registry server. If the registry is not specified, the first registry under `[registries.search]` from `registries.conf` will be used.
-name:Log out of default registry
+podman_logout:
+
+-name:Log out of quay.io
+podman_logout:
+registry:quay.io
+
+-name:Log out of all registries in auth file
+podman_logout:
+all:true
+
+-name:Log out of all registries in specified auth file
+podman_logout:
+authfile:$HOME/.docker/config.json
+all:true
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_network_info.
-name:Gather info about all present networks
+containers.podman.podman_network_info:
+
+-name:Gather info about specific network
+containers.podman.podman_network_info:
+name:podman
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_network.
Return additional information which can be helpful for investigations.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
disable_dns
+
boolean
+
+
disable dns plugin (default “false”)
+
Choices:
+
+
false
+
true
+
+
+
+
+
dns
+
list / elements=string
+
+
Set network-scoped DNS resolver/nameserver for containers in this network. If not set, the host servers from /etc/resolv.conf is used.
+
+
+
+
driver
+
string
+
+
Driver to manage the network (default “bridge”)
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
+
Default:"podman"
+
+
+
+
force
+
boolean
+
+
Remove all containers that use the network. If the container is running, it is stopped and removed.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
gateway
+
string
+
+
IPv4 or IPv6 gateway for the subnet
+
+
+
+
interface_name
+
string
+
+
For bridge, it uses the bridge interface name. For macvlan, it is the parent device on the host (it is the same as ‘opt.parent’)
+
+
+
+
internal
+
boolean
+
+
Restrict external access from this network (default “false”)
+
Choices:
+
+
false
+
true
+
+
+
+
+
ip_range
+
string
+
+
Allocate container IP from range
+
+
+
+
ipam_driver
+
string
+
+
Set the ipam driver (IP Address Management Driver) for the network. When unset podman chooses an ipam driver automatically based on the network driver
+
Choices:
+
+
"host-local"
+
"dhcp"
+
"none"
+
+
+
+
+
ipv6
+
boolean
+
+
Enable IPv6 (Dual Stack) networking. You must pass a IPv6 subnet. The subnet option must be used with the ipv6 option. Idempotency is not supported because it generates subnets randomly.
+
Choices:
+
+
false
+
true
+
+
+
+
+
macvlan
+
string
+
+
Create a Macvlan connection based on this device
+
+
+
+
name
+
string / required
+
+
Name of the network
+
+
+
+
net_config
+
list / elements=dictionary
+
+
List of dictionaries with network configuration. Each dictionary should contain ‘subnet’ and ‘gateway’ keys. ‘ip_range’ is optional.
+
+
+
+
gateway
+
string / required
+
+
Gateway for the subnet
+
+
+
+
ip_range
+
string
+
+
Allocate container IP from range
+
+
+
+
subnet
+
string / required
+
+
Subnet in CIDR format
+
+
+
+
opt
+
dictionary
+
+
Add network options. Currently ‘vlan’ and ‘mtu’ are supported.
+
+
+
+
bclim
+
integer
+
+
Set the threshold for broadcast queueing. Must be a 32 bit integer. Setting this value to -1 disables broadcast queueing altogether.
+
+
+
+
bridge_name
+
string
+
+
This option assigns the given name to the created Linux Bridge. Sets ‘com.docker.network.bridge.name’ option.
+
+
+
+
driver_mtu
+
string
+
+
Sets the Maximum Transmission Unit (MTU) and takes an integer value. Sets ‘com.docker.network.driver.mtu’ option.
+
+
+
+
isolate
+
boolean
+
+
This option isolates networks by blocking traffic between those that have this option enabled.
+
Choices:
+
+
false
+
true
+
+
+
+
+
metric
+
integer
+
+
Sets the Route Metric for the default route created in every container joined to this network. Can only be used with the Netavark network backend.
+
+
+
+
mode
+
string
+
+
This option sets the specified ip/macvlan mode on the interface.
+
+
+
+
mtu
+
integer
+
+
MTU size for bridge network interface.
+
+
+
+
no_default_route
+
string
+
+
If set to 1, Podman will NOT automatically add a default route to subnets.
+
+
+
+
parent
+
string
+
+
The host device which should be used for the macvlan interface (it is the same as ‘interface’ in that case). Defaults to the default route interface.
+
+
+
+
vlan
+
integer
+
+
VLAN tag for bridge which enables vlan_filtering.
+
+
+
+
vrf
+
string
+
+
This option assigns a VRF to the bridge interface. It accepts the name of the VRF and defaults to none. Can only be used with the Netavark network backend.
+
+
+
+
quadlet_dir
+
path
+
+
Path to the directory to write quadlet file in. By default, it will be set as /etc/containers/systemd/ for root user, ~/.config/containers/systemd/ for non-root users.
+
+
+
+
quadlet_file_mode
+
any
+
+
The permissions of the quadlet file.
+
The quadlet_file_mode can be specied as octal numbers or as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r). For octal numbers format, you must either add a leading zero so that Ansible’s YAML parser knows it is an octal number (like 0644 or 01777) or quote it (like '644' or '1777') so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results.
+
If quadlet_file_mode is not specified and the quadlet file does not exist, the default '0640' mask will be used when setting the mode for the newly created file.
+
If quadlet_file_mode is not specified and the quadlet file does exist, the mode of the existing file will be used.
+
Specifying quadlet_file_mode is the best way to ensure files are created with the correct permissions.
+
+
+
+
quadlet_filename
+
string
+
+
Name of quadlet file to write. By default it takes name value.
+
+
+
+
quadlet_options
+
list / elements=string
+
+
Options for the quadlet file. Provide missing in usual network args options as a list of lines to add.
+
+
+
+
recreate
+
boolean
+
+
Recreate network even if exists.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
route
+
list / elements=string
+
+
A static route in the format <destination in CIDR notation>,<gateway>,<route metric (optional)>. This route will be added to every container in this network.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_play.
Path of the authentication file. Default is ${XDG_RUNTIME_DIR}/containers/auth.json, which is set using podman login. If the authorization state is not found there, $HOME/.docker/config.json is checked, which is set using docker login. Note - You can also override the default path of the authentication file by setting the REGISTRY_AUTH_FILE environment variable. export REGISTRY_AUTH_FILE=path
+
+
+
+
build
+
boolean
+
+
Build images even if they are found in the local storage.
+
It is required to exist subdirectories matching the image names to be build.
+
Choices:
+
+
false
+
true
+
+
+
+
+
cert_dir
+
path
+
+
Use certificates at path (*.crt, *.cert, *.key) to connect to the registry. Default certificates directory is /etc/containers/certs.d. (This option is not available with the remote Podman client)
+
+
+
+
configmap
+
list / elements=path
+
+
Use Kubernetes configmap YAML at path to provide a source for environment variable values within the containers of the pod. Note - The configmap option can be used multiple times to pass multiple Kubernetes configmap YAMLs
+
+
+
+
context_dir
+
path
+
+
Use path as the build context directory for each image. Requires build option be true.
+
+
+
+
debug
+
boolean
+
+
Enable debug for the module.
+
Choices:
+
+
false
+
true
+
+
+
+
+
executable
+
string
+
+
Name of executable to run, by default ‘podman’
+
Default:"podman"
+
+
+
+
kube_file
+
path
+
+
Path to file with YAML configuration for a Pod.
+
+
+
+
kube_file_content
+
string
+
+
Content of the kube file.
+
+
+
+
log_driver
+
string
+
+
Set logging driver for all created containers.
+
+
+
+
log_level
+
string
+
+
Set logging level for podman calls. Log messages above specified level (“debug”|”info”|”warn”|”error”|”fatal”|”panic”) (default “error”)
+
Choices:
+
+
"debug"
+
"info"
+
"warn"
+
"error"
+
"fatal"
+
"panic"
+
+
+
+
+
+
log_opt
+
aliases: log_options
+
dictionary
+
+
Logging driver specific options. Set custom logging configuration.
+
+
+
+
+
max_size
+
string
+
+
Specify a max size of the log file (e.g 10mb).
+
+
+
+
+
path
+
string
+
+
specify a path to the log file (e.g. /var/log/container/mycontainer.json).
+
+
+
+
+
tag
+
string
+
+
Specify a custom log tag for the container. This option is currently supported only by the journald log driver in Podman.
+
+
+
+
network
+
list / elements=string
+
+
List of the names of CNI networks the pod should join.
+
+
+
+
password
+
string
+
+
The username and password to use to authenticate with the registry if required.
+
+
+
+
quadlet_dir
+
path
+
+
Path to the directory to write quadlet file in. By default, it will be set as /etc/containers/systemd/ for root user, ~/.config/containers/systemd/ for non-root users.
+
+
+
+
quadlet_file_mode
+
any
+
+
The permissions of the quadlet file.
+
The quadlet_file_mode can be specied as octal numbers or as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r). For octal numbers format, you must either add a leading zero so that Ansible’s YAML parser knows it is an octal number (like 0644 or 01777) or quote it (like '644' or '1777') so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results.
+
If quadlet_file_mode is not specified and the quadlet file does not exist, the default '0640' mask will be used when setting the mode for the newly created file.
+
If quadlet_file_mode is not specified and the quadlet file does exist, the mode of the existing file will be used.
+
Specifying quadlet_file_mode is the best way to ensure files are created with the correct permissions.
+
+
+
+
quadlet_filename
+
string
+
+
Name of quadlet file to write. Must be specified if state is quadlet.
+
+
+
+
quadlet_options
+
list / elements=string
+
+
Options for the quadlet file. Provide missing in usual network args options as a list of lines to add.
+
+
+
+
quiet
+
boolean
+
+
Hide image pulls logs from output.
+
Choices:
+
+
false
+
true
+
+
+
+
+
recreate
+
boolean
+
+
If pod already exists, delete it and run the new one.
+
Choices:
+
+
false
+
true
+
+
+
+
+
seccomp_profile_root
+
path
+
+
Directory path for seccomp profiles (default is “/var/lib/kubelet/seccomp”). This option is not available with the remote Podman client
+
+
+
+
state
+
string / required
+
+
Start the pod after creating it, or to leave it created only.
+
Choices:
+
+
"created"
+
"started"
+
"absent"
+
"quadlet"
+
+
+
+
+
tls_verify
+
boolean
+
+
Require HTTPS and verify certificates when contacting registries (default is true). If explicitly set to true, then TLS verification will be used. If set to false, then TLS verification will not be used. If not specified, TLS verification will be used unless the target registry is listed as an insecure registry in registries.conf.
+
Choices:
+
+
false
+
true
+
+
+
+
+
username
+
string
+
+
The username and password to use to authenticate with the registry if required.
+
+
+
+
userns
+
string
+
+
Set the user namespace mode for all the containers in a pod. It defaults to the PODMAN_USERNS environment variable. An empty value (“”) means user namespaces are disabled.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_pod_info.
-name:Gather info about all present pods
+containers.podman.podman_pod_info:
+
+-name:Gather info about specific pods
+containers.podman.podman_pod_info:
+name:special_pod
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_pod.
Add a host to the /etc/hosts file shared between all containers in the pod.
+
+
+
+
blkio_weight
+
string
+
+
Block IO relative weight. The weight is a value between 10 and 1000.
+
This option is not supported on cgroups V1 rootless systems.
+
+
+
+
blkio_weight_device
+
list / elements=string
+
+
Block IO relative device weight.
+
+
+
+
cgroup_parent
+
string
+
+
Path to cgroups under which the cgroup for the pod will be created. If the path is not absolute, he path is considered to be relative to the cgroups path of the init process. Cgroups will be created if they do not already exist.
+
+
+
+
cpu_shares
+
string
+
+
CPU shares (relative weight).
+
+
+
+
cpus
+
string
+
+
Set the total number of CPUs delegated to the pod. Default is 0.000 which indicates that there is no limit on computation power.
+
+
+
+
cpuset_cpus
+
string
+
+
Limit the CPUs to support execution. First CPU is numbered 0. Unlike `cpus` this is of type string and parsed as a list of numbers. Format is 0-3,0,1
+
+
+
+
cpuset_mems
+
string
+
+
Memory nodes in which to allow execution (0-3, 0,1). Only effective on NUMA systems.
+
+
+
+
debug
+
boolean
+
+
Return additional information which can be helpful for investigations.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
device
+
list / elements=string
+
+
Add a host device to the pod. Optional permissions parameter can be used to specify device permissions. It is a combination of r for read, w for write, and m for mknod(2)
+
+
+
+
device_read_bps
+
list / elements=string
+
+
Limit read rate (bytes per second) from a device (e.g. device-read-bps=/dev/sda:1mb)
+
+
+
+
device_write_bps
+
list / elements=string
+
+
Limit write rate (in bytes per second) to a device.
+
+
+
+
dns
+
list / elements=string
+
+
Set custom DNS servers in the /etc/resolv.conf file that will be shared between all containers in the pod. A special option, “none” is allowed which disables creation of /etc/resolv.conf for the pod.
+
+
+
+
+
dns_opt
+
aliases: dns_option
+
list / elements=string
+
+
Set custom DNS options in the /etc/resolv.conf file that will be shared between all containers in the pod.
+
+
+
+
dns_search
+
list / elements=string
+
+
Set custom DNS search domains in the /etc/resolv.conf file that will be shared between all containers in the pod.
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
+
Default:"podman"
+
+
+
+
exit_policy
+
string
+
+
Set the exit policy of the pod when the last container exits. Supported policies are stop and continue
+
Choices:
+
+
"stop"
+
"continue"
+
+
+
+
+
generate_systemd
+
dictionary
+
+
Generate systemd unit file for container.
+
Default:{}
+
+
+
+
after
+
list / elements=string
+
+
Add the systemd unit after (After=) option, that ordering dependencies between the list of dependencies and this service.
+
+
+
+
container_prefix
+
string
+
+
Set the systemd unit name prefix for containers. The default is “container”.
+
+
+
+
names
+
boolean
+
+
Use names of the containers for the start, stop, and description in the unit file. Default is true.
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
new
+
boolean
+
+
Create containers and pods when the unit is started instead of expecting them to exist. The default is “false”. Refer to podman-generate-systemd(1) for more information.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
no_header
+
boolean
+
+
Do not generate the header including meta data such as the Podman version and the timestamp. From podman version 3.1.0.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
path
+
string
+
+
Specify a path to the directory where unit files will be generated. Required for this option. If it doesn’t exist, the directory will be created.
+
+
+
+
pod_prefix
+
string
+
+
Set the systemd unit name prefix for pods. The default is “pod”.
+
+
+
+
requires
+
list / elements=string
+
+
Set the systemd unit requires (Requires=) option. Similar to wants, but declares a stronger requirement dependency.
+
+
+
+
restart_policy
+
string
+
+
Specify a restart policy for the service. The restart-policy must be one of “no”, “on-success”, “on-failure”, “on-abnormal”, “on-watchdog”, “on-abort”, or “always”. The default policy is “on-failure”.
+
Choices:
+
+
"no"
+
"on-success"
+
"on-failure"
+
"on-abnormal"
+
"on-watchdog"
+
"on-abort"
+
"always"
+
+
+
+
+
restart_sec
+
integer
+
+
Set the systemd service restartsec value.
+
+
+
+
separator
+
string
+
+
Set the systemd unit name separator between the name/id of a container/pod and the prefix. The default is “-” (dash).
+
+
+
+
start_timeout
+
integer
+
+
Override the default start timeout for the container with the given value.
+
+
+
+
+
stop_timeout
+
aliases: time
+
integer
+
+
Override the default stop timeout for the container with the given value. Called `time` before version 4.
+
+
+
+
wants
+
list / elements=string
+
+
Add the systemd unit wants (Wants=) option, that this service is (weak) dependent on.
+
+
+
+
gidmap
+
list / elements=string
+
+
GID map for the user namespace. Using this flag will run the container with user namespace enabled. It conflicts with the `userns` and `subgidname` flags.
+
+
+
+
gpus
+
string
+
+
GPU devices to add to the container (‘all’ to pass all GPUs).
+
+
+
+
hostname
+
string
+
+
Set a hostname to the pod
+
+
+
+
infra
+
boolean
+
+
Create an infra container and associate it with the pod. An infra container is a lightweight container used to coordinate the shared kernel namespace of a pod. Default is true.
+
Choices:
+
+
false
+
true
+
+
+
+
+
infra_command
+
string
+
+
The command that will be run to start the infra container. Default is “/pause”.
+
+
+
+
infra_conmon_pidfile
+
string
+
+
Write the pid of the infra container’s conmon process to a file. As conmon runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods.
+
+
+
+
infra_image
+
string
+
+
The image that will be created for the infra container. Default is “k8s.gcr.io/pause:3.1”.
+
+
+
+
infra_name
+
string
+
+
The name that will be used for the pod’s infra container.
+
+
+
+
ip
+
string
+
+
Set a static IP for the pod’s shared network.
+
+
+
+
ip6
+
string
+
+
Set a static IPv6 for the pod’s shared network.
+
+
+
+
label
+
dictionary
+
+
Add metadata to a pod, pass dictionary of label keys and values.
+
+
+
+
label_file
+
string
+
+
Read in a line delimited file of labels.
+
+
+
+
mac_address
+
string
+
+
Set a static MAC address for the pod’s shared network.
+
+
+
+
memory
+
string
+
+
Set memory limit.
+
A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes).
+
+
+
+
memory_swap
+
string
+
+
Set limit value equal to memory plus swap.
+
A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes).
+
+
+
+
name
+
string / required
+
+
Assign a name to the pod.
+
+
+
+
network
+
list / elements=string
+
+
Set network mode for the pod. Supported values are bridge (the default), host (do not create a network namespace, all containers in the pod will use the host’s network), or a list of names of CNI networks to join.
+
+
+
+
+
network_alias
+
aliases: network_aliases
+
list / elements=string
+
+
Add a network-scoped alias for the pod, setting the alias for all networks that the pod joins. To set a name only for a specific network, use the alias option as described under the -`network` option. Network aliases work only with the bridge networking mode. This option can be specified multiple times.
+
+
+
+
no_hosts
+
boolean
+
+
Disable creation of /etc/hosts for the pod.
+
Choices:
+
+
false
+
true
+
+
+
+
+
pid
+
string
+
+
Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via `share` option.
+
+
+
+
pod_id_file
+
string
+
+
Write the pod ID to the file.
+
+
+
+
+
publish
+
aliases: ports
+
list / elements=string
+
+
Publish a port or range of ports from the pod to the host.
+
+
+
+
quadlet_dir
+
path
+
+
Path to the directory to write quadlet file in. By default, it will be set as /etc/containers/systemd/ for root user, ~/.config/containers/systemd/ for non-root users.
+
+
+
+
quadlet_file_mode
+
any
+
+
The permissions of the quadlet file.
+
The quadlet_file_mode can be specied as octal numbers or as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r). For octal numbers format, you must either add a leading zero so that Ansible’s YAML parser knows it is an octal number (like 0644 or 01777) or quote it (like '644' or '1777') so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results.
+
If quadlet_file_mode is not specified and the quadlet file does not exist, the default umask on the system will be used when setting the mode for the newly created file.
+
If quadlet_file_mode is not specified and the quadlet file does exist, the mode of the existing file will be used.
+
Specifying quadlet_file_mode is the best way to ensure files are created with the correct permissions.
+
+
+
+
quadlet_filename
+
string
+
+
Name of quadlet file to write. By default it takes name value.
+
+
+
+
quadlet_options
+
list / elements=string
+
+
Options for the quadlet file. Provide missing in usual container args options as a list of lines to add.
+
+
+
+
recreate
+
boolean
+
+
Use with present and started states to force the re-creation of an existing pod.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
restart_policy
+
string
+
+
Restart policy to follow when containers exit.
+
+
+
+
security_opt
+
list / elements=string
+
+
Security options for the pod.
+
+
+
+
share
+
string
+
+
A comma delimited list of kernel namespaces to share. If none or “” is specified, no namespaces will be shared. The namespaces to choose from are ipc, net, pid, user, uts.
+
+
+
+
share_parent
+
boolean
+
+
This boolean determines whether or not all containers entering the pod use the pod as their cgroup parent. The default value of this option in Podman is true.
+
Choices:
+
+
false
+
true
+
+
+
+
+
shm_size
+
string
+
+
Set the size of the /dev/shm shared memory space. A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes). If the unit is omitted, the system uses bytes. If the size is omitted, the default is 64m. When size is 0, there is no limit on the amount of memory used for IPC by the pod.
+
+
+
+
shm_size_systemd
+
string
+
+
Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp. A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes). If the unit is omitted, the system uses bytes. If the size is omitted, the default is 64m. When size is 0, the usage is limited to 50 percents of the host’s available memory.
+
+
+
+
state
+
string
+
+
This variable is set for state
+
Choices:
+
+
"created"← (default)
+
"killed"
+
"restarted"
+
"absent"
+
"started"
+
"stopped"
+
"paused"
+
"unpaused"
+
"quadlet"
+
+
+
+
+
subgidname
+
string
+
+
Name for GID map from the /etc/subgid file. Using this flag will run the container with user namespace enabled. This flag conflicts with `userns` and `gidmap`.
+
+
+
+
subuidname
+
string
+
+
Name for UID map from the /etc/subuid file. Using this flag will run the container with user namespace enabled. This flag conflicts with `userns` and `uidmap`.
+
+
+
+
sysctl
+
dictionary
+
+
Set kernel parameters for the pod.
+
+
+
+
uidmap
+
list / elements=string
+
+
Run the container in a new user namespace using the supplied mapping. This option conflicts with the `userns` and `subuidname` options. This option provides a way to map host UIDs to container UIDs. It can be passed several times to map different ranges.
+
+
+
+
userns
+
string
+
+
Set the user namespace mode for all the containers in a pod. It defaults to the PODMAN_USERNS environment variable. An empty value (“”) means user namespaces are disabled.
# What modules does for example
+-containers.podman.podman_pod:
+name:pod1
+state:started
+ports:
+-"4444:5555"
+
+# Connect random port from localhost to port 80 on pod2
+-name:Connect random port from localhost to port 80 on pod2
+containers.podman.podman_pod:
+name:pod2
+state:started
+publish:"127.0.0.1::80"
+
+# Full workflow example with pod and containers
+-name:Create a pod with parameters
+containers.podman.podman_pod:
+name:mypod
+state:created
+network:host
+share:net
+userns:auto
+security_opt:
+-seccomp=unconfined
+-apparmor=unconfined
+hostname:mypod
+dns:
+-1.1.1.1
+volumes:
+-/tmp:/tmp/:ro
+label:
+key:cval
+otherkey:kddkdk
+somekey:someval
+add_host:
+-"google:5.5.5.5"
+
+-name:Create containers attached to the pod
+containers.podman.podman_container:
+name:"{{item}}"
+state:created
+pod:mypod
+image:alpine
+command:sleep 1h
+loop:
+-"container1"
+-"container2"
+
+-name:Start pod
+containers.podman.podman_pod:
+name:mypod
+state:started
+network:host
+share:net
+userns:auto
+security_opt:
+-seccomp=unconfined
+-apparmor=unconfined
+hostname:mypod
+dns:
+-1.1.1.1
+volumes:
+-/tmp:/tmp/:ro
+label:
+key:cval
+otherkey:kddkdk
+somekey:someval
+add_host:
+-"google:5.5.5.5"
+
+# Create a Quadlet file for a pod
+-containers.podman.podman_pod:
+name:qpod
+state:quadlet
+ports:
+-"4444:5555"
+volume:
+-/var/run/docker.sock:/var/run/docker.sock
+quadlet_dir:/custom/dir
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_prune.
A dictionary of filter values used for selecting images to delete.
+
You can also use dangling_only:false to delete dangling and non-dangling images or external:true to delete images even when they are used by external containers.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_runlabel.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_save.
podman save saves an image to either docker-archive, oci-archive, oci-dir (directory with oci manifest type), or docker-dir (directory with v2s2 manifest type) on the local machine, default is docker-archive.
Compress tarball image layers when pushing to a directory using the ‘dir’ transport. (default is same compression type, compressed or uncompressed, as source)
+
Choices:
+
+
false
+
true
+
+
+
+
+
+
dest
+
aliases: path
+
string / required
+
+
Destination file to write image to.
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
+
Default:"podman"
+
+
+
+
force
+
boolean
+
+
Force saving to file even if it exists.
+
Choices:
+
+
false
+
true← (default)
+
+
+
+
+
format
+
string
+
+
Save image to docker-archive, oci-archive (see containers-transports(5)), oci-dir (oci transport), or docker-dir (dir transport with v2s2 manifest type).
+
Choices:
+
+
"docker-archive"
+
"oci-archive"
+
"oci-dir"
+
"docker-dir"
+
+
+
+
+
image
+
list / elements=string / required
+
+
Image to save.
+
+
+
+
multi_image_archive
+
boolean
+
+
Allow for creating archives with more than one image. Additional names will be interpreted as images instead of tags. Only supported for docker-archive.
# What modules does for example
+-containers.podman.podman_save:
+image:nginx
+dest:/tmp/file123.tar
+-containers.podman.podman_save:
+image:
+-nginx
+-fedora
+dest:/tmp/file456.tar
+multi_image_archive:true
+
-name:Search for any rhel images
+containers.podman.podman_search:
+term:"rhel"
+limit:3
+
+-name:Gather info on a specific remote image
+containers.podman.podman_search:
+term:"myimageregistry.com/ansible-automation-platform/ee-minimal-rhel8"
+
+-name:Gather tag info on a known remote image
+containers.podman.podman_search:
+term:"myimageregistry.com/ansible-automation-platform/ee-minimal-rhel8"
+list_tags:True
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_secret_info.
-name:Gather info about all present secrets
+podman_secret_info:
+
+-name:Gather info about specific secret
+podman_secret_info:
+name:specific_secret
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_secret.
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_system_info.
-name:Get Podman system information
+containers.podman.podman_system_info:
+
+-name:Get Podman system information into a variable
+containers.podman.podman_system_info:
+register:podman_info
+-name:Printing Podman System info
+debug:
+msg:"{{podman_info['podman_system_info']}}"
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_tag.
Configuration entries listed above for each entry type (Ansible variable, environment variable, and so on) have a low to high priority order.
+For example, a variable that is lower in the list will override a variable that is higher up.
+The entry types are also ordered by precedence from low to high priority order.
+For example, an ansible.cfg entry (further up in the list) is overwritten by an Ansible variable (further down in the list).
-name:checking uid of file 'foo'
+ansible.builtin.stat:
+path:"{{test_dir}}/foo"
+register:foo
+-ansible.builtin.debug:
+var:foo.stat.uid
+# The output shows that it's owned by the login user
+# ok: [test_host] => {
+# "foo.stat.uid": "1003"
+# }
+
+-name:mounting the file to an unprivileged container and modifying its owner
+containers.podman.podman_container:
+name:chmod_foo
+image:alpine
+rm:true
+volume:
+-"{{test_dir}}:/opt/test:z"
+command:chown 1000 /opt/test/foo
+
+# Now the file 'foo' is owned by the container uid 1000,
+# which is mapped to something completaly different on the host.
+# It creates a situation when the file is unaccessible to the host user (uid 1003)
+# Running stat again, debug output will be like this:
+# ok: [test_host] => {
+# "foo.stat.uid": "328679"
+# }
+
+-name:running stat in modified user namespace
+become_method:containers.podman.podman_unshare
+become:true
+ansible.builtin.stat:
+path:"{{test_dir}}/foo"
+register:foo
+# By gathering file stats with podman_ushare
+# we can see the uid set in the container:
+# ok: [test_host] => {
+# "foo.stat.uid": "1000"
+# }
+
+-name:resetting file ownership with podman unshare
+become_method:containers.podman.podman_unshare
+become:true
+ansible.builtin.file:
+state:file
+path:"{{test_dir}}/foo"
+owner:0# in a modified user namespace host uid is mapped to 0
+# If we run stat and debug with 'become: false',
+# we can see that the file is ours again:
+# ok: [test_host] => {
+# "foo.stat.uid": "1003"
+# }
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_volume_info.
-name:Gather info about all present volumes
+podman_volume_info:
+
+-name:Gather info about specific volume
+podman_volume_info:
+name:specific_volume
+
It is not included in ansible-core.
+To check whether it is installed, run ansible-galaxycollectionlist.
+
To install it, use: ansible-galaxycollectioninstallcontainers.podman.
+You need further requirements to be able to use this module,
+see Requirements for details.
+
To use it in a playbook, specify: containers.podman.podman_volume.
Return additional information which can be helpful for investigations.
+
Choices:
+
+
false← (default)
+
true
+
+
+
+
+
driver
+
string
+
+
Specify volume driver name (default local).
+
+
+
+
executable
+
string
+
+
Path to podman executable if it is not in the $PATH on the machine running podman
+
Default:"podman"
+
+
+
+
label
+
dictionary
+
+
Add metadata to a pod volume (e.g., label com.example.key=value).
+
+
+
+
name
+
string / required
+
+
Name of volume.
+
+
+
+
options
+
list / elements=string
+
+
Set driver specific options. For example ‘device=tpmfs’, ‘type=tmpfs’. UID and GID idempotency is not supported due to changes in podman.
+
+
+
+
quadlet_dir
+
path
+
+
Path to the directory to write quadlet file in. By default, it will be set as /etc/containers/systemd/ for root user, ~/.config/containers/systemd/ for non-root users.
+
+
+
+
quadlet_file_mode
+
any
+
+
The permissions of the quadlet file.
+
The quadlet_file_mode can be specied as octal numbers or as a symbolic mode (for example, u+rwx or u=rw,g=r,o=r). For octal numbers format, you must either add a leading zero so that Ansible’s YAML parser knows it is an octal number (like 0644 or 01777) or quote it (like '644' or '1777') so Ansible receives a string and can do its own conversion from string into number. Giving Ansible a number without following one of these rules will end up with a decimal number which will have unexpected results.
+
If quadlet_file_mode is not specified and the quadlet file does not exist, the default '0640' mask will be used when setting the mode for the newly created file.
+
If quadlet_file_mode is not specified and the quadlet file does exist, the mode of the existing file will be used.
+
Specifying quadlet_file_mode is the best way to ensure files are created with the correct permissions.
+
+
+
+
quadlet_filename
+
string
+
+
Name of quadlet file to write. By default it takes name value.
+
+
+
+
quadlet_options
+
list / elements=string
+
+
Options for the quadlet file. Provide missing in usual network args options as a list of lines to add.
# What modules does for example
+-name:Create a volume
+containers.podman.podman_volume:
+state:present
+name:volume1
+label:
+key:value
+key2:value2
+options:
+-"device=/dev/loop1"
+-"type=ext4"
+
+-name:Create a Quadlet file for a volume
+containers.podman.podman_volume:
+state:quadlet
+name:quadlet_volume
+quadlet_filename:custom-name
+quadlet_file_mode:'0640'
+quadlet_options:
+-Group=192
+-Copy=true
+-Image=quay.io/centos/centos:latest
+
The following index documents all environment variables declared by plugins in collections.
+Environment variables used by the ansible-core configuration are documented in Ansible Configuration Settings.
The following index documents all environment variables declared by plugins in collections.
-Environment variables used by the ansible-core configuration are documented in ansible_configuration_settings.
+ 
+ 
+ 
+