NAME¶ 名称
podman-pod-clone - Create a copy of an existing pod
podman-pod-clone - 创建现有 pod 的副本
SYNOPSIS¶ 概要
podman pod clone [options] pod name
podman pod clone [选项] pod 名称
DESCRIPTION¶ 描述
podman pod clone creates a copy of a pod, recreating the identical config for the pod and for all of its containers. Users can modify the pods new name and select pod details within the infra container
podman pod clone 创建一个 pod 的副本，重新创建 pod 和其所有容器的相同配置。用户可以修改 pod 的新名称，并在基础设施容器中选择 pod 详细信息。
OPTIONS¶ 选项
--blkio-weight=weight¶ --blkio-weight=权重 ¶
Block IO relative weight. The weight is a value between 10 and 1000.
块 IO 相对权重。权重的取值范围为 10 到 1000。
This option is not supported on cgroups V1 rootless systems.
此选项不支持 cgroups V1 无根系统。
--blkio-weight-device=device:weight¶
--blkio-weight-device=设备:权重 ¶
Block IO relative device weight.
块 IO 相对设备权重。
--cgroup-parent=path¶
Path to cgroups under which the cgroup for the pod is created. If the
path is not absolute, the path is considered to be relative to the cgroups path
of the init process. Cgroups are created if they do not already exist.
创建 Pod 的 cgroup 所在的 cgroups 路径。如果路径不是绝对路径，则将其视为相对于 init 进程的 cgroups 路径。如果这些 cgroups 不存在，则会创建它们。
--cpus¶
Set a number of CPUs for the pod that overrides the original pods CPU limits. If none are specified, the original pod’s Nano CPUs are used.
为 Pod 设置一个 CPU 数，覆盖原始 Pod 的 CPU 限制。如果未指定任何值，则使用原始 Pod 的 Nano CPU。
--cpuset-cpus=number¶
CPUs in which to allow execution. Can be specified as a comma-separated list
(e.g. 0,1), as a range (e.g. 0-3), or any combination thereof
(e.g. 0-3,7,11-15).
允许执行的 CPU。可以指定为逗号分隔的列表（例如 0,1），作为范围（例如 0-3），或两者的任意组合（例如 0-3,7,11-15）。
On some systems, changing the resource limits may not be allowed for non-root
users. For more details, see
https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
在某些系统上，非 root 用户可能无法更改资源限制。有关更多详细信息，请参阅 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
This option is not supported on cgroups V1 rootless systems.
此选项不支持 cgroups V1 无根系统。
If none are specified, the original pod’s CPUset is used.
如果未指定任何值，则使用原始 Pod 的 CPUset。
--cpuset-mems=nodes¶
Memory nodes (MEMs) in which to allow execution (0-3, 0,1). Only effective on
NUMA systems.
允许执行的内存节点（MEMs）（0-3, 0,1）。仅在 NUMA 系统上有效。
If there are four memory nodes on the system (0-3), use --cpuset-mems=0,1
then processes in the container only uses memory from the first
two memory nodes.
如果系统上有四个内存节点（0-3），则使用--cpuset-mems=0,1，然后容器中的进程仅使用来自前两个内存节点的内存。
On some systems, changing the resource limits may not be allowed for non-root
users. For more details, see
https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
在某些系统上，非 root 用户可能无法更改资源限制。有关更多详细信息，请参阅 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
This option is not supported on cgroups V1 rootless systems.
此选项不支持 cgroups V1 无根系统。
--destroy¶
Remove the original pod that we are cloning once used to mimic the configuration.
一旦用于模拟配置，删除我们正在克隆的原始 pod。
--device=host-device[:container-device][:permissions]¶
--device=主机设备[:容器设备][:权限] ¶
Add a host device to the pod. Optional permissions parameter
can be used to specify device permissions by combining
r for read, w for write, and m for mknod(2).
向 pod 添加主机设备。可选的权限参数可用于通过组合 r 表示读取，w 表示写入，m 表示 mknod(2) 来指定设备权限。
Example: --device=/dev/sdc:/dev/xvdc:rwm.
示例: --device=/dev/sdc:/dev/xvdc:rwm.
Note: if host-device is a symbolic link then it is resolved first.
The pod only stores the major and minor numbers of the host device.
注意：如果主机设备是符号链接，则首先解析它。Pod 仅存储主机设备的主次编号。
Podman may load kernel modules required for using the specified
device. The devices that Podman loads modules for when necessary are:
/dev/fuse.
Podman 可能会加载使用指定设备所需的内核模块。Podman 在必要时加载模块的设备有: /dev/fuse。
In rootless mode, the new device is bind mounted in the container from the host
rather than Podman creating it within the container space. Because the bind
mount retains its SELinux label on SELinux systems, the container can get
permission denied when accessing the mounted device. Modify SELinux settings to
allow containers to use all device labels via the following command:
在无根模式下，新设备是从主机中绑定挂载到容器中，而不是 Podman 在容器空间内创建它。由于绑定挂载在 SELinux 系统上保留其 SELinux 标签，当容器访问挂载的设备时可能会出现权限被拒绝的情况。通过以下命令修改 SELinux 设置以允许容器使用所有设备标签：
$ sudo setsebool -P container_use_devices=true
Note: the pod implements devices by storing the initial configuration passed by the user and recreating the device on each container added to the pod.
注意：Pod 通过存储用户传递的初始配置并在添加到 Pod 的每个容器上重新创建设备来实现设备。
--device-read-bps=path:rate¶
Limit read rate (in bytes per second) from a device (e.g. --device-read-bps=/dev/sda:1mb).
限制从设备读取速率（以每秒字节数为单位）（例如 --device-read-bps=/dev/sda:1mb）。
On some systems, changing the resource limits may not be allowed for non-root
users. For more details, see
https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
在某些系统上，非 root 用户可能无法更改资源限制。有关更多详细信息，请参阅 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
This option is not supported on cgroups V1 rootless systems.
此选项不支持 cgroups V1 无根系统。
--device-write-bps=path:rate¶
Limit write rate (in bytes per second) to a device (e.g. --device-write-bps=/dev/sda:1mb).
限制设备的写入速率（以每秒字节为单位）（例如 --device-write-bps=/dev/sda:1mb）。
On some systems, changing the resource limits may not be allowed for non-root
users. For more details, see
https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
在某些系统上，非 root 用户可能无法更改资源限制。有关更多详细信息，请参阅 https://github.com/containers/podman/blob/main/troubleshooting.md#26-running-containers-with-resource-limits-fails-with-a-permissions-error
This option is not supported on cgroups V1 rootless systems.
此选项不支持 cgroups V1 无根系统。
--gidmap=pod_gid:host_gid:amount¶
GID map for the user namespace. Using this flag runs all containers in the pod with user namespace enabled.
It conflicts with the --userns and --subgidname flags.
用户命名空间的 GID 映射。使用此标志在启用用户命名空间的情况下运行 Pod 中的所有容器。它与 --userns 和 --subgidname 标志冲突。
--gpus=ENTRY¶ --gpus=ENTRY
GPU devices to add to the container (‘all’ to pass all GPUs) Currently only
Nvidia devices are supported.
要添加到容器中的 GPU 设备（使用 'all' 表示所有 GPU）目前仅支持 Nvidia 设备。
--help, -h¶ --help，-h ¶
Print usage statement. 打印使用说明。
--hostname=name¶ --主机名=名称 ¶
Set a hostname to the pod.
为 pod 设置主机名。
--infra-command=command¶
--基础设施命令=命令 ¶
The command that is run to start the infra container. Default: “/pause”.
运行基础设施容器的命令。默认值：“/pause”。
--infra-conmon-pidfile=file¶
Write the pid of the infra container’s conmon process to a file. As conmon runs in a separate process than Podman, this is necessary when using systemd to manage Podman containers and pods.
将基础设施容器的 conmon 进程的 pid 写入文件。由于 conmon 运行在与 Podman 不同的进程中，因此在使用 systemd 管理 Podman 容器和 pod 时，这是必要的。
--infra-name=name¶
The name that is used for the pod’s infra container.
用于 Pod 基础设施容器的名称。
--label, -l=key=value¶ --label，-l=key=value ¶
Add metadata to a pod.
向 Pod 添加元数据。
--label-file=file¶
Read in a line-delimited file of labels.
读取一个以行分隔的标签文件。
--memory, -m=number[unit]¶
--memory, -m=数字[单位] ¶
Memory limit. A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes).
内存限制。单位可以是 b（字节）、k（基比字节）、m（兆比字节）或 g（吉比字节）。
Allows the memory available to a container to be constrained. If the host
supports swap memory, then the -m memory setting can be larger than physical
RAM. If a limit of 0 is specified (not using -m), the container’s memory is
not limited. The actual limit may be rounded up to a multiple of the operating
system’s page size (the value is very large, that’s millions of trillions).
允许限制容器可用的内存。如果主机支持交换内存，那么 -m 内存设置可以大于物理 RAM。如果指定了 0 的限制（不使用 -m），则容器的内存不受限制。实际限制可能会舍入到操作系统页面大小的倍数（该值非常大，是百万亿的数量级）。
This option is not supported on cgroups V1 rootless systems.
此选项不支持 cgroups V1 无根系统。
--memory-swap=number[unit]¶
A limit value equal to memory plus swap.
A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes).
一个等于内存加交换空间的限制值。单位可以是 b（字节）、k（kibibytes）、m（mebibytes）或 g（gibibytes）。
Must be used with the -m (--memory) flag.
The argument value must be larger than that of
-m (--memory) By default, it is set to double
the value of --memory.
必须与 -m (--memory) 标志一起使用。参数值必须大于 -m (--memory) 的值。默认情况下，它设置为 --memory 值的两倍。
Set number to -1 to enable unlimited swap.
将数字设置为 -1 以启用无限交换。
This option is not supported on cgroups V1 rootless systems.
此选项不支持 cgroups V1 无根系统。
--name, -n¶ --名称, -n ¶
Set a custom name for the cloned pod. The default if not specified is of the syntax: <ORIGINAL_NAME>-clone
为克隆的 Pod 设置自定义名称。如果未指定，默认语法为：<ORIGINAL_NAME>-clone
--pid=pid¶
Set the PID mode for the pod. The default is to create a private PID namespace for the pod. Requires the PID namespace to be shared via --share.
为 Pod 设置 PID 模式。默认情况下，为 Pod 创建一个私有 PID 命名空间。需要通过 --share 共享 PID 命名空间。
host: use the host’s PID namespace for the pod
ns: join the specified PID namespace
private: create a new namespace for the pod (default)
--restart=policy¶
Restart policy to follow when containers exit.
Restart policy does not take effect if a container is stopped via the podman kill or podman stop commands.
容器退出时要遵循的重启策略。 如果通过 podman kill 或 podman stop 命令停止容器，则重启策略不会生效。
Valid policy values are: 有效的策略值为:
no: Do not restart containers on exit
no：退出时不重新启动容器never: Synonym for no; do not restart containers on exit
never：no 的同义词; 退出时不重新启动容器on-failure[:max_retries]: Restart containers when they exit with a non-zero exit code, retrying indefinitely or until the optional max_retries count is hit
on-failure[:max_retries]：当容器以非零退出代码退出时重新启动容器，无限重试，或直到达到可选的 max_retries 计数always: Restart containers when they exit, regardless of status, retrying indefinitely
always：当容器退出时重新启动容器，无论状态如何，无限重试unless-stopped: Identical to always
unless-stopped：与 always 相同
Podman provides a systemd unit file, podman-restart.service, which restarts containers after a system reboot.
Podman 提供了一个 systemd 单元文件，podman-restart.service，在系统重启后重新启动容器。
When running containers in systemd services, use the restart functionality provided by systemd.
In other words, do not use this option in a container unit, instead set the Restart= systemd directive in the [Service] section.
See podman-systemd.unit(5) and systemd.service(5).
在 systemd 服务中运行容器时，请使用 systemd 提供的重启功能。换句话说，请不要在容器单元中使用此选项，而是在 [Service] 部分中设置 Restart= systemd 指令。请参阅 podman-systemd.unit(5) 和 systemd.service(5)。
Default restart policy for all the containers in a pod.
Pod 中所有容器的默认重启策略。
--security-opt=option¶ --security-opt=option
Security Options 安全选项
apparmor=unconfined : Turn off apparmor confinement for the pod
apparmor=unconfined：为 pod 关闭 apparmor 限制apparmor=alternate-profile : Set the apparmor confinement profile for the pod
apparmor=alternate-profile：为 pod 设置 apparmor 限制配置文件label=user:USER: Set the label user for the pod processes
label=user:USER：为 pod 进程设置用户标签label=role:ROLE: Set the label role for the pod processes
标签=角色: 为 pod 进程设置标签角色label=type:TYPE: Set the label process type for the pod processes
标签=类型: 为 pod 进程设置标签进程类型label=level:LEVEL: Set the label level for the pod processes
标签=级别: 为 pod 进程设置标签级别label=filetype:TYPE: Set the label file type for the pod files
标签=filetype:类型: 为 pod 文件设置标签文件类型label=disable: Turn off label separation for the pod
标签=disable: 关闭 pod 的标签分离
Note: Labeling can be disabled for all pods/containers by setting label=false in the containers.conf (/etc/containers/containers.conf or $HOME/.config/containers/containers.conf) file.
注意: 可以通过在 containers.conf ( /etc/containers/containers.conf 或 $HOME/.config/containers/containers.conf ) 文件中设置 label=false 来禁用所有 pods/containers 的标签化。
label=nested: Allows SELinux modifications within the container. Containers are allowed to modify SELinux labels on files and processes, as long as SELinux policy allows. Without nested, containers view SELinux as disabled, even when it is enabled on the host. Containers are prevented from setting any labels.
label=nested: 允许容器内进行 SELinux 修改。只要 SELinux 策略允许，容器就可以修改文件和进程的 SELinux 标签。没有嵌套，容器会将 SELinux 视为已禁用，即使在主机上已启用。容器被阻止设置任何标签。mask=/path/1:/path/2: The paths to mask separated by a colon. A masked path cannot be accessed inside the containers within the pod.
mask=/path/1:/path/2：由冒号分隔的要屏蔽的路径。在 Pod 内的容器中无法访问被屏蔽的路径。no-new-privileges: Disable container processes from gaining additional privileges.
no-new-privileges: 禁止容器进程获取额外的特权。seccomp=unconfined: Turn off seccomp confinement for the pod.
seccomp=unconfined：为 Pod 关闭 seccomp 限制。seccomp=profile.json: JSON file to be used as a seccomp filter. Note that the
io.podman.annotations.seccompannotation is set with the specified value as shown inpodman inspect.
seccomp=profile.json：要用作 seccomp 过滤器的 JSON 文件。请注意，io.podman.annotations.seccomp注释将设置为所示的指定值。proc-opts=OPTIONS : Comma-separated list of options to use for the /proc mount. More details for the possible mount options are specified in the proc(5) man page.
proc-opts=OPTIONS：用于 /proc 挂载的逗号分隔选项列表。有关可能的挂载选项的更多详细信息，请参阅 proc(5) 手册页。unmask=ALL or /path/1:/path/2, or shell expanded paths (/proc/*): Paths to unmask separated by a colon. If set to ALL, it unmasks all the paths that are masked or made read-only by default. The default masked paths are /proc/acpi, /proc/kcore, /proc/keys, /proc/latency_stats, /proc/sched_debug, /proc/scsi, /proc/timer_list, /proc/timer_stats, /sys/firmware, and /sys/fs/selinux, /sys/devices/virtual/powercap. The default paths that are read-only are /proc/asound, /proc/bus, /proc/fs, /proc/irq, /proc/sys, /proc/sysrq-trigger, /sys/fs/cgroup.
unmask=ALL 或/path/1:/path/2，或 shell 扩展路径(/proc/*)：以冒号分隔的要解除掩码的路径。如果设置为 ALL，则解除掩码或默认情况下设置为只读的所有路径。默认的掩码路径包括/proc/acpi、/proc/kcore、/proc/keys、/proc/latency_stats、/proc/sched_debug、/proc/scsi、/proc/timer_list、/proc/timer_stats、/sys/firmware 和/sys/fs/selinux、/sys/devices/virtual/powercap。默认的只读路径包括/proc/asound、/proc/bus、/proc/fs、/proc/irq、/proc/sys、/proc/sysrq-trigger、/sys/fs/cgroup。
Note: Labeling can be disabled for all containers by setting label=false in the containers.conf(5) file.
注意：可以通过在 containers.conf(5)文件中设置 label=false 来禁用所有容器的标签。
--shm-size=number[unit]¶
--shm-size=number[unit]
Size of /dev/shm. A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes).
If the unit is omitted, the system uses bytes. If the size is omitted, the default is 64m.
When size is 0, there is no limit on the amount of memory used for IPC by the pod.
This option conflicts with --ipc=host.
/dev/shm 的大小。单位可以是 b（字节）、k（kibibytes）、m（mebibytes）或 g（gibibytes）。如果省略单位，则系统使用字节。如果省略大小，则默认为 64m。当大小为 0 时，Pod 使用的 IPC 内存量不受限制。此选项与 --ipc=host 冲突。
--shm-size-systemd=number[unit]¶
--shm-size-systemd=数字[unit]
Size of systemd-specific tmpfs mounts such as /run, /run/lock, /var/log/journal and /tmp.
A unit can be b (bytes), k (kibibytes), m (mebibytes), or g (gibibytes).
If the unit is omitted, the system uses bytes. If the size is omitted, the default is 64m.
When size is 0, the usage is limited to 50% of the host’s available memory.
systemd 特定 tmpfs 挂载的大小，例如 /run、/run/lock、/var/log/journal 和 /tmp。单位可以是 b（字节）、k（kibibytes）、m（mebibytes）或 g（gibibytes）。如果省略单位，则系统使用字节。如果省略大小，则默认为 64m。当大小为 0 时，使用量限制为主机可用内存的 50%。
--start¶
When set to true, this flag starts the newly created pod after the
clone process has completed. All containers within the pod are started.
当设置为 true 时，此标志在克隆过程完成后启动新创建的 Pod。Pod 中的所有容器都会启动。
--subgidname=name¶ --subgidname=名称 ¶
Run the container in a new user namespace using the map with name in the /etc/subgid file.
If running rootless, the user needs to have the right to use the mapping. See subgid(5).
This flag conflicts with --userns and --gidmap.
在新的用户命名空间中使用 /etc/subgid 文件中的名称映射来运行容器。如果以 rootless 模式运行，则用户需要有使用映射的权限。请参阅 subgid(5)。此标志与 --userns 和 --gidmap 冲突。
--subuidname=name¶
Run the container in a new user namespace using the map with name in the /etc/subuid file.
If running rootless, the user needs to have the right to use the mapping. See subuid(5).
This flag conflicts with --userns and --uidmap.
在新的用户命名空间中使用 /etc/subuid 文件中的名称映射来运行容器。如果以 rootless 模式运行，则用户需要有使用映射的权限。请参阅 subuid(5)。此标志与 --userns 和 --uidmap 冲突。
--sysctl=name=value¶
Configure namespaced kernel parameters for all containers in the pod.
为 Pod 中的所有容器配置命名空间内核参数。
For the IPC namespace, the following sysctls are allowed:
对于 IPC 命名空间，允许以下 sysctl：
kernel.msgmax 内核.msgmax
kernel.msgmnb 内核.msgmnb
kernel.msgmni 内核.msgmni
kernel.sem 内核.sem
kernel.shmall 内核.shmall
kernel.shmmax 内核.shmmax
kernel.shmmni 内核.shmmni
kernel.shm_rmid_forced 内核.shm_rmid_forced
Sysctls beginning with fs.mqueue.*
以 fs.mqueue.* 开头的 Sysctls
Note: if the ipc namespace is not shared within the pod, the above sysctls are not allowed.
注意：如果 IPC 命名空间在 Pod 内部不共享，则上述 sysctl 是不允许的。
For the network namespace, only sysctls beginning with net.* are allowed.
对于网络命名空间，只允许使用以 net.* 开头的 sysctl。
Note: if the network namespace is not shared within the pod, the above sysctls are not allowed.
注意：如果网络命名空间在 pod 中不共享，则上述 sysctl 是不允许的。
--uidmap=container_uid:from_uid:amount¶
Run all containers in the pod in a new user namespace using the supplied mapping. This
option conflicts with the --userns and --subuidname options. This
option provides a way to map host UIDs to container UIDs. It can be passed
several times to map different ranges.
在新的用户命名空间中使用提供的映射运行 pod 中的所有容器。此选项与 --userns 和 --subuidname 选项冲突。此选项提供了一种将主机 UID 映射到容器 UID 的方法。可以多次传递此选项以映射不同的范围。
--userns=mode¶ --userns=mode
Set the user namespace mode for all the containers in a pod. It defaults to the PODMAN_USERNS environment variable. An empty value (“”) means user namespaces are disabled.
为 Pod 中的所有容器设置用户命名空间模式。默认为 PODMAN_USERNS 环境变量。空值（“”）表示用户命名空间已禁用。
Rootless user --userns=Key mappings:
无根用户--userns=Key 映射：
Key |
Host User 主机用户 |
Container User 容器用户 |
|---|---|---|
“” |
$UID |
0 (Default User account mapped to root user in container.) |
host |
$UID |
0 (Default User account mapped to root user in container.) |
keep-id |
$UID |
$UID (Map user account to same UID within container.) |
auto |
$UID |
nil (Host User UID is not mapped into container.) |
nomap |
$UID |
nil (Host User UID is not mapped into container.) |
Valid mode values are: 有效的模式值为：
auto[:OPTIONS,…]: automatically create a namespace. It is possible to specify these options to
auto:
auto[:OPTIONS,…]: 自动创建命名空间。可以将这些选项指定给auto：gidmapping=CONTAINER_GID:HOST_GID:SIZE to force a GID mapping to be present in the user namespace.
gidmapping=CONTAINER_GID:HOST_GID:SIZE 强制在用户命名空间中存在 GID 映射。size=SIZE: to specify an explicit size for the automatic user namespace. e.g.
--userns=auto:size=8192. Ifsizeis not specified,autoestimates the size for the user namespace.
size=SIZE: 为自动用户命名空间指定显式大小。例如--userns=auto:size=8192。如果未指定size，auto会为用户命名空间估算大小。uidmapping=CONTAINER_UID:HOST_UID:SIZE to force a UID mapping to be present in the user namespace.
uidmapping=CONTAINER_UID:HOST_UID:SIZE 强制在用户命名空间中存在 UID 映射。
host: run in the user namespace of the caller. The processes running in the container have the same privileges on the host as any other process launched by the calling user (default).
主机：在调用者的用户命名空间中运行。在容器中运行的进程在主机上具有与调用用户启动的任何其他进程相同的特权（默认）。keep-id: creates a user namespace where the current rootless user’s UID:GID are mapped to the same values in the container. This option is not allowed for containers created by the root user.
保持 ID：创建一个用户命名空间，其中当前无根用户的 UID:GID 映射到容器中的相同值。此选项不允许由 root 用户创建的容器使用。nomap: creates a user namespace where the current rootless user’s UID:GID are not mapped into the container. This option is not allowed for containers created by the root user.
nomap: 创建一个用户命名空间，其中当前无根用户的 UID:GID 不映射到容器中。此选项不允许由 root 用户创建的容器使用。
--uts=mode¶
Set the UTS namespace mode for the pod. The following values are supported:
设置 pod 的 UTS 命名空间模式。支持以下值：
host: use the host’s UTS namespace inside the pod.
主机：在 pod 内部使用主机的 UTS 命名空间。private: create a new namespace for the pod (default).
私有：为 pod 创建一个新的命名空间（默认）。ns:[path]: run the pod in the given existing UTS namespace.
ns:[路径]：在给定的现有 UTS 命名空间中运行 pod。
--volume, -v=[[SOURCE-VOLUME|HOST-DIR:]CONTAINER-DIR[:OPTIONS]]¶
--volume, -v=[[源卷|主机目录:]容器目录[:选项]] ¶
Create a bind mount. If -v /HOST-DIR:/CONTAINER-DIR is specified, Podman
bind mounts /HOST-DIR from the host into /CONTAINER-DIR in the Podman
container. Similarly, -v SOURCE-VOLUME:/CONTAINER-DIR mounts the named
volume from the host into the container. If no such named volume exists,
Podman creates one. If no source is given, the volume is created
as an anonymously named volume with a randomly generated name, and is
removed when the pod is removed via the --rm flag or
the podman rm --volumes command.
创建一个绑定挂载。如果指定了 -v /HOST-DIR:/CONTAINER-DIR ，Podman 会将主机中的 /HOST-DIR 绑定挂载到 Podman 容器中的 /CONTAINER-DIR 。类似地， -v SOURCE-VOLUME:/CONTAINER-DIR 将命名卷从主机绑定到容器中。如果没有这样的命名卷存在，Podman 会创建一个。如果没有给出源，卷将作为一个随机生成的匿名命名卷创建，并在通过 --rm 标志或 podman rm --volumes 命令删除 pod 时被删除。
(Note when using the remote client, including Mac and Windows (excluding WSL2) machines, the volumes are mounted from the remote server, not necessarily the client machine.)
（注意，当使用远程客户端时，包括 Mac 和 Windows（不包括 WSL2）机器时，卷是从远程服务器挂载的，而不一定是客户端机器。）
The OPTIONS is a comma-separated list and can be one or more of:
OPTIONS 是一个逗号分隔的列表，可以是一个或多个:
rw|ro 读写|只读
z|Z
[O]
[U]
[no]copy
[no]dev [不]开发
[no]exec [不]执行
[no]suid [不]SUID
[r]bind [r]绑定
[r]shared|[r]slave|[r]private[r]unbindable [1]
[r]共享|[r]从属|[r]私有[r]不可解绑 [1]idmap[=options] id 映射[=选项]
The CONTAINER-DIR must be an absolute path such as /src/docs. The volume
is mounted into the container at this directory.
" CONTAINER-DIR " 必须是绝对路径，例如 " /src/docs "。卷被挂载到容器中的这个目录。
If a volume source is specified, it must be a path on the host or the name of a
named volume. Host paths are allowed to be absolute or relative; relative paths
are resolved relative to the directory Podman is run in. If the source does not
exist, Podman returns an error. Users must pre-create the source files or
directories.
如果指定了卷源，则必须是主机上的路径或命名卷的名称。主机路径可以是绝对或相对的；相对路径相对于 Podman 运行的目录解析。如果源不存在，Podman 将返回错误。用户必须预先创建源文件或目录。
Any source that does not begin with a . or / is treated as the name of
a named volume. If a volume with that name does not exist, it is created.
Volumes created with names are not anonymous, and they are not removed by the --rm
option and the podman rm --volumes command.
任何不以 " . " 或 " / " 开头的源都被视为命名卷的名称。如果不存在具有该名称的卷，则会创建它。使用名称创建的卷不是匿名的，并且不会被 " --rm " 选项和 " podman rm --volumes " 命令移除。
Specify multiple -v options to mount one or more volumes into a
pod.
指定多个-v 选项将一个或多个卷挂载到一个 pod 中。
Write Protected Volume Mounts
Add :ro or :rw option to mount a volume in read-only or
read-write mode, respectively. By default, the volumes are mounted read-write.
See examples.
添加 :ro 或 :rw 选项以分别以只读或读写模式挂载卷，默认情况下，卷以读写模式挂载。请参阅示例。
Chowning Volume Mounts
By default, Podman does not change the owner and group of source volume
directories mounted into containers. If a pod is created in a new
user namespace, the UID and GID in the container may correspond to another UID
and GID on the host.
默认情况下，Podman 不会更改挂载到容器中的源卷目录的所有者和组。如果在新的用户命名空间中创建了一个 pod，容器中的 UID 和 GID 可能对应于主机上的另一个 UID 和 GID。
The :U suffix tells Podman to use the correct host UID and GID based on the
UID and GID within the pod, to change recursively the owner and
group of the source volume. Chowning walks the file system under the volume and
changes the UID/GID on each file. If the volume has thousands of inodes, this
process takes a long time, delaying the start of the pod.
" :U "后缀告诉 Podman 根据 pod 中的 UID 和 GID 使用正确的主机 UID 和 GID，递归更改源卷的所有者和组。Chowning 遍历卷下的文件系统，并更改每个文件的 UID/GID。如果卷有数千个 inode，则此过程需要很长时间，延迟 pod 的启动。
Warning use with caution since this modifies the host filesystem.
警告谨慎使用，因为这会修改主机文件系统。
Labeling Volume Mounts
Labeling systems like SELinux require that proper labels are placed on volume
content mounted into a pod. Without a label, the security system
might prevent the processes running inside the pod from using the
content. By default, Podman does not change the labels set by the OS.
像 SELinux 这样的标记系统要求在挂载到 pod 中的卷内容上放置适当的标记。如果没有标记，安全系统可能会阻止在 pod 内部运行的进程使用内容。默认情况下，Podman 不会更改操作系统设置的标签。
To change a label in the pod context, add either of two suffixes
:z or :Z to the volume mount. These suffixes tell Podman to relabel file
objects on the shared volumes. The z option tells Podman that two or more
pods share the volume content. As a result, Podman labels the
content with a shared content label. Shared volume labels allow all containers
to read/write content. The Z option tells Podman to label the content with
a private unshared label Only the current pod can use a private
volume. Relabeling walks the file system under the volume and changes the label
on each file, if the volume has thousands of inodes, this process takes a
long time, delaying the start of the pod. If the volume
was previously relabeled with the z option, Podman is optimized to not relabel
a second time. If files are moved into the volume, then the labels can be
manually change with the chcon -Rt container_file_t PATH command.
要在 pod 上下文中更改标签，请在卷挂载中添加两个后缀之一：:z 或 :Z。这些后缀告诉 Podman 在共享卷上重新标记文件对象。z 选项告诉 Podman 两个或更多个 pod 共享卷内容。因此，Podman 使用共享内容标签标记内容。共享卷标签允许所有容器读取/写入内容。Z 选项告诉 Podman 使用私有未共享标签标记内容。只有当前 pod 可以使用私有卷。重新标记会遍历卷下的文件系统，并更改每个文件的标签，如果卷有数千个 inode，则此过程需要很长时间，延迟 pod 的启动。如果卷之前使用 z 选项重新标记过，则 Podman 会优化以避免二次重新标记。如果文件移动到卷中，则可以使用 chcon -Rt container_file_t PATH 命令手动更改标签。
Note: Do not relabel system files and directories. Relabeling system content
might cause other confined services on the machine to fail. For these types
of containers we recommend disabling SELinux separation. The option
--security-opt label=disable disables SELinux separation for the pod.
For example if a user wanted to volume mount their entire home directory into a
pod, they need to disable SELinux separation.
注意: 不要重新标记系统文件和目录。重新标记系统内容可能导致机器上其他受限服务失败。对于这些类型的容器，我们建议禁用 SELinux 分离。选项 --security-opt label=disable 会为 pod 禁用 SELinux 分离。例如，如果用户想要将他们整个家目录挂载到一个 pod 中，他们需要禁用 SELinux 分离。
$ podman pod clone --security-opt label=disable -v $HOME:/home/user fedora touch /home/user/file
Overlay Volume Mounts
The :O flag tells Podman to mount the directory from the host as a
temporary storage using the overlay file system. The pod processes
can modify content within the mountpoint which is stored in the
container storage in a separate directory. In overlay terms, the source
directory is the lower, and the container storage directory is the
upper. Modifications to the mount point are destroyed when the pod
finishes executing, similar to a tmpfs mount point being unmounted.
:O 标志告诉 Podman 将主机上的目录作为临时存储挂载，使用 overlay file system 。pod 进程可以修改挂载点内的内容，该内容存储在容器存储中的一个单独目录中。在叠加术语中，源目录是下层，容器存储目录是上层。对挂载点的修改在 pod 执行完成时被销毁，类似于 tmpfs 挂载点被卸载时的情况。
For advanced users, the overlay option also supports custom non-volatile
upperdir and workdir for the overlay mount. Custom upperdir and
workdir can be fully managed by the users themselves, and Podman does not
remove it on lifecycle completion.
Example :O,upperdir=/some/upper,workdir=/some/work
对于高级用户，overlay 选项还支持自定义非易失性 upperdir 和 workdir 用于叠加挂载。自定义的 upperdir 和 workdir 可完全由用户自行管理，Podman 在生命周期完成时不会删除它。示例：O,upperdir=/some/upper,workdir=/some/work
Subsequent executions of the container sees the original source directory
content, any changes from previous pod executions no longer exist.
容器的后续执行会看到原始源目录内容，之前 pod 执行的任何更改都不再存在。
One use case of the overlay mount is sharing the package cache from the
host into the container to allow speeding up builds.
叠加挂载的一个用例是将主机中的软件包缓存共享到容器中，以加快构建速度。
Note: The O flag conflicts with other options listed above.
注意： O 标志与上面列出的其他选项存在冲突。
Content mounted into the container is labeled with the private label.
On SELinux systems, labels in the source directory must be readable
by the pod infra container label. Usually containers can read/execute container_share_t
and can read/write container_file_t. If unable to change the labels on a
source volume, SELinux container separation must be disabled for the pod or infra container
to work.
安装到容器中的内容带有私有标签。在 SELinux 系统上，源目录中的标签必须可被 pod 基础设施容器标签读取。通常容器可以读取/执行 container_share_t 并且可以读取/写入 container_file_t 。如果无法更改源卷上的标签，则必须为 pod 或基础设施容器禁用 SELinux 容器隔离才能正常工作。
Do not modify the source directory mounted into the pod with an overlay mount,
it can cause unexpected failures. Only modify the directory after the container finishes running.
不要使用覆盖挂载修改挂载到 pod 中的源目录，这可能会导致意外故障。只能在容器运行完成后修改目录。
Mounts propagation
By default, bind-mounted volumes are private. That means any mounts done
inside the pod are not visible on the host and vice versa.
One can change this behavior by specifying a volume mount propagation property.
When a volume is shared, mounts done under that volume inside the pod
are visible on host and vice versa. Making a volume slave[1]
enables only one-way mount propagation: mounts done on the host under that volume
are visible inside the container but not the other way around.
默认情况下，绑定挂载的卷是 private 。这意味着在 pod 内部进行的任何挂载对主机都不可见，反之亦然。可以通过指定卷挂载传播属性来更改此行为。当一个卷是 shared 时，在 pod 内部该卷下进行的挂载对主机可见，反之亦然。将卷设置为 slave [1] 可以启用单向挂载传播：在主机上该卷下进行的挂载在容器内部可见，但反之则不行。
To control mount propagation property of a volume one can use the [r]shared,
[r]slave, [r]private or the [r]unbindable propagation flag.
Propagation property can be specified only for bind mounted volumes and not for
internal volumes or named volumes. For mount propagation to work the source mount
point (the mount point where source dir is mounted on) has to have the right propagation
properties. For shared volumes, the source mount point has to be shared. And for
slave volumes, the source mount point has to be either shared or slave.
[1]
要控制卷的挂载传播属性，可以使用[r]shared、[r]slave、[r]private 或[r]unbindable 传播标志。传播属性只能针对绑定挂载的卷进行指定，而不能针对内部卷或命名卷进行指定。要使挂载传播生效，源挂载点（源目录挂载的挂载点）必须具有正确的传播属性。对于共享卷，源挂载点必须是共享的。对于从属卷，源挂载点必须是共享的或从属的。 [1]
To recursively mount a volume and all of its submounts into a
pod, use the rbind option. By default the bind option is
used, and submounts of the source directory is not mounted into the
pod.
为了递归地将一个卷及其所有子卷挂载到一个 pod 中，使用 rbind 选项。默认情况下使用 bind 选项，并且源目录的子卷不会被挂载到 pod 中。
Mounting the volume with a copy option tells podman to copy content from
the underlying destination directory onto newly created internal volumes. The
copy only happens on the initial creation of the volume. Content is not
copied up when the volume is subsequently used on different containers. The
copy option is ignored on bind mounts and has no effect.
使用复制选项挂载卷告诉 podman 从底层目标目录复制内容到新创建的内部卷。复制仅在卷的初始创建时发生。在不同容器上后续使用卷时，内容不会被复制。复制选项在绑定挂载上被忽略且无效果。
Mounting volumes with the nosuid options means that SUID executables on the
volume can not be used by applications to change their privilege. By default
volumes are mounted with nosuid.
使用 nosuid 选项挂载卷意味着卷上的 SUID 可执行文件不能被应用程序用来更改它们的特权。默认情况下，卷是使用 nosuid 挂载的。
Mounting the volume with the noexec option means that no executables on the
volume can be executed within the pod.
使用 noexec 选项挂载卷意味着卷上的可执行文件不能在 pod 中执行。
Mounting the volume with the nodev option means that no devices on the volume
can be used by processes within the pod. By default volumes
are mounted with nodev.
使用 nodev 选项挂载卷意味着卷上的设备不能被 pod 内的进程使用。默认情况下，卷是以 nodev 挂载的。
If the HOST-DIR is a mount point, then dev, suid, and exec options are
ignored by the kernel.
如果 HOST-DIR 是一个挂载点，则内核会忽略 dev、suid 和 exec 选项。
Use df HOST-DIR to figure out the source mount, then use
findmnt -o TARGET,PROPAGATION source-mount-dir to figure out propagation
properties of source mount. If findmnt(1) utility is not available, then one
can look at the mount entry for the source mount point in /proc/self/mountinfo. Look
at the “optional fields” and see if any propagation properties are specified.
In there, shared:N means the mount is shared, master:N means mount
is slave, and if nothing is there, the mount is private. [1]
使用 df HOST-DIR 来查找源挂载点，然后使用 findmnt -o TARGET,PROPAGATION source-mount-dir 来查找源挂载点的传播属性。如果 findmnt(1) 实用程序不可用，则可以查看 /proc/self/mountinfo 中源挂载点的挂载条目。查看“可选字段”，看看是否指定了任何传播属性。在那里，shared:N 表示挂载是共享的，master:N 表示挂载是从属的，如果没有任何内容，则挂载是私有的。 [1]
To change propagation properties of a mount point, use mount(8) command. For
example, if one wants to bind mount source directory /foo, one can do
mount --bind /foo /foo and mount --make-private --make-shared /foo. This
converts /foo into a shared mount point. Alternatively, one can directly
change propagation properties of source mount. Say / is source mount for
/foo, then use mount --make-shared / to convert / into a shared mount.
要更改挂载点的传播属性，请使用 mount(8) 命令。例如，如果要绑定挂载源目录 /foo，则可以执行 mount --bind /foo /foo 和 mount --make-private --make-shared /foo。这将把 /foo 转换为共享挂载点。或者，可以直接更改源挂载点的传播属性。假设 / 是 /foo 的源挂载点，则使用 mount --make-shared / 来将 / 转换为共享挂载点。
Note: if the user only has access rights via a group, accessing the volume
from inside a rootless pod fails.
注意: 如果用户仅通过组具有访问权限，则无法从无根 pod 内部访问卷。
Idmapped mount
If idmap is specified, create an idmapped mount to the target user
namespace in the container. The idmap option supports a custom mapping
that can be different than the user namespace used by the
container. The mapping can be specified after the idmap option like:
idmap=uids=0-1-10#10-11-10;gids=0-100-10.
For each triplet, the first value is the start of the backing file
system IDs that are mapped to the second value on the host. The
length of this mapping is given in the third value.
Multiple ranges are separated with #.
如果指定了 idmap ，则在容器中为目标用户命名空间创建一个 idmapped 挂载点。idmap 选项支持自定义映射，可以与容器使用的用户命名空间不同。映射可以在 idmap 选项之后指定，如： idmap=uids=0-1-10#10-11-10;gids=0-100-10 。对于每个三元组，第一个值是映射到主机上第二个值的后备文件系统 ID 的起始值。此映射的长度在第三个值中给出。多个范围用 # 分隔。
--volumes-from=CONTAINER[:OPTIONS]¶
Mount volumes from the specified container(s). Used to share volumes between
containers and pods. The options is a comma-separated list with the following available elements:
从指定的容器中挂载卷。用于在容器和 pod 之间共享卷。选项是一个逗号分隔的列表，包含以下可用元素:
rw|ro 读写|只读
z
Mounts already mounted volumes from a source container onto another
pod. CONTAINER may be a name or ID.
To share a volume, use the --volumes-from option when running
the target container. Volumes can be shared even if the source container
is not running.
将已经挂载的卷从源容器挂载到另一个 pod 上。CONTAINER 可以是名称或 ID。要共享卷，请在运行目标容器时使用 --volumes-from 选项。即使源容器未运行，也可以共享卷。
By default, Podman mounts the volumes in the same mode (read-write or
read-only) as it is mounted in the source container.
This can be changed by adding a ro or rw option.
默认情况下，Podman 以与源容器中挂载的模式（读写或只读）相同的模式挂载卷。可以通过添加 ro 或 rw 选项来更改这一点。
Labeling systems like SELinux require that proper labels are placed on volume
content mounted into a pod. Without a label, the security system might
prevent the processes running inside the container from using the content. By
default, Podman does not change the labels set by the OS.
像 SELinux 这样的标签系统要求在挂载到 Pod 中的卷内容上放置适当的标签。如果没有标签，安全系统可能会阻止容器内运行的进程使用内容。默认情况下，Podman 不会更改操作系统设置的标签。
To change a label in the pod context, add z to the volume mount.
This suffix tells Podman to relabel file objects on the shared volumes. The z
option tells Podman that two entities share the volume content. As a result,
Podman labels the content with a shared content label. Shared volume labels allow
all containers to read/write content.
要在 pod 上下文中更改标签，请将 z 添加到卷挂载中。此后缀告诉 Podman 重新标记共享卷上的文件对象。 z 选项告诉 Podman 两个实体共享卷内容。因此，Podman 使用共享内容标签标记内容。共享卷标签允许所有容器读取/写入内容。
If the location of the volume from the source container overlaps with
data residing on a target pod, then the volume hides
that data on the target.
如果源容器中卷的位置与目标 pod 上的数据重叠，则该卷会隐藏目标上的数据。
EXAMPLES¶ 示例
Clone the specified pod to a new pod.
克隆指定的 Pod 到一个新的 Pod。
# podman pod clone pod-name
6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584
Clone the specified pod to a new pod with a new name.
将指定的 Pod 克隆到一个带有新名称的新 Pod。
# podman pod clone pod-name --name=cloned-pod
d0cf1f782e2ed67e8c0050ff92df865a039186237a4df24d7acba5b1fa8cc6e7
6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584
Clone and remove the specified pod to a new pod, modifying its cpus.
克隆并移除指定的 Pod 到一个新的 Pod，修改其 CPU。
# podman pod clone --destroy --cpus=5 d0cf1
6b2c73ff8a1982828c9ae2092954bcd59836a131960f7e05221af9df5939c584
Clone the specified pod to a new named pod.
克隆指定的 Pod 到一个新命名的 Pod。
# podman pod clone 2d4d4fca7219b4437e0d74fcdc272c4f031426a6eacd207372691207079551de new_name
5a9b7851013d326aa4ac4565726765901b3ecc01fcbc0f237bc7fd95588a24f9
SEE ALSO¶ 参见 ¶
HISTORY¶ 历史 ¶
May 2022, Originally written by Charlie Doern cdoern@redhat.com
2022 年 5 月，原文作者 Charlie Doern cdoern@redhat.com
FOOTNOTES¶ 脚注 ¶
1: The Podman project is committed to inclusivity, a core value of open source. The master and slave mount propagation terminology used here is problematic and divisive, and needs to be changed. However, these terms are currently used within the Linux kernel and must be used as-is at this time. When the kernel maintainers rectify this usage, Podman will follow suit immediately.
1：Podman 项目致力于包容性，这是开源的核心价值观。这里使用的 master 和 slave 挂载传播术语存在问题和分歧，需要进行更改。然而，这些术语目前在 Linux 内核中使用，因此目前必须按原样使用。当内核维护者纠正这种用法时，Podman 将立即跟进。