<div class="container">
<h1>Recommended update for podman</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-RU-2023:4628-1</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1210299">bsc#1210299</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1215807">bsc#1215807</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1215926">bsc#1215926</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-7287">jsc#PED-7287</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">Containers Module 15-SP5</li>
<li class="list-group-item">openSUSE Leap 15.5</li>
<li class="list-group-item">SUSE Linux Enterprise High Performance Computing 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Micro 5.5</li>
<li class="list-group-item">SUSE Linux Enterprise Real Time 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server 15 SP5</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP Applications 15 SP5</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that contains one feature and has three fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for podman fixes the following issues:</p>
<p>This update ships podman version 4.7.2:</p>
<ul>
<li>WSL: Fixed podman compose command.</li>
<li>Fixed a bug in podman compose to try all configured providers before throwing an error (#20502).</li>
<li>
<p>Mask /sys/devices/virtual/powercap ( GHSA-jq35-85cj-fj4p)</p>
</li>
<li>
<p>podman-docker: Provides docker to avoid conflicts
when using podman with docker-compose (bsc#1215926)</p>
</li>
<li>
<p>Update to version 4.7.1:</p>
</li>
<li>
<p>Bugfixes</p>
<ul>
<li>Fixed a bug involving non-English locales of Windows where machine installs using user-mode networking were rejected due to erroneous version detection (#20209).</li>
<li>Fixed a regression in --env-file handling (#19565).</li>
<li>Fixed a bug where podman inspect would fail when stat'ing a device failed.</li>
</ul>
</li>
<li>
<p>API</p>
<ul>
<li>The network list compat API endpoint is now much faster (#20035).</li>
</ul>
</li>
<li>
<p>Build against latest stable Go version (bsc#1215807)</p>
</li>
<li>
<p>Update to version 4.7.0:</p>
</li>
<li>
<p>Security</p>
<ul>
<li>Now the io.containers.capabilities LABEL in an image can be an empty string.</li>
</ul>
</li>
<li>
<p>Features</p>
<ul>
<li>New command set: podman farm [create,list,remove,update] has been created to "farm" out builds to machines running Podman for different architectures.</li>
<li>New command: podman compose as a thin wrapper around an external compose provider such as docker-compose or podman-compose.</li>
<li>FreeBSD: podman run --device is now supported.</li>
<li>Linux: Add a new --module flag for Podman.</li>
<li>Podmansh: Timeout is now configurable using the podmansh_timeout option in containers.conf.</li>
<li>SELinux: Add support for confined users to create containers but restrict them from creating privileged containers.</li>
<li>WSL: Registers shared socket bindings on Windows, to allow other WSL distributions easy remote access (#15190).</li>
<li>WSL: Enabling user-mode-networking on older WSL2 generations will now detect an error with upgrade guidance.</li>
<li>The podman build command now supports two new options: --layer-label and --cw.</li>
<li>The podman kube generate command now supports generation of k8s DaemonSet kind (#18899).</li>
<li>The podman kube generate and podman kube play commands now support the k8s TerminationGracePeriodSeconds field (RH BZ#2218061).</li>
<li>The podman kube generate and podman kube play commands now support securityContext.procMount: Unmasked (#19881).</li>
<li>The podman generate kube command now supports a --podman-only flag to allow podman-only reserved annotations to be used in the generated YAML file. These annotations cannot be used by Kubernetes.</li>
<li>The podman kube generate now supports a --no-trunc flag that supports YAML files with annotations longer than 63 characters. Warning: if an annotation is longer than 63 chars, then the generated yaml file is not Kubernetes compatible.</li>
<li>An infra name annotation io.podman.annotations.infra.name is added in the generated yaml when the pod create command has --infra-name set. This annotation can also be used with kube play when wanting to customize the infra container name (#18312).</li>
<li>The syntax of --uidmap and --gidmap has been extended to lookup the parent user namespace and to extend default mappings (#18333).</li>
<li>The podman kube commands now support the List kind (#19052).</li>
<li>The podman kube play command now supports environment variables in kube.yaml (#15983).</li>
<li>The podman push and podman manifest push commands now support the --force-compression optionto prevent reusing other blobs (#18860).</li>
<li>The podman manifest push command now supports --add-compression to push with compressed variants.</li>
<li>The podman manifest push command now honors the add_compression field from containers.conf if --add-compression is not set.</li>
<li>The podman run and podman create --mount commands now support the ramfs type (#19659).</li>
<li>When running under systemd (e.g., via Quadlet), Podman will extend the start timeout in 30 second steps up to a maximum of 5 minutes when pulling an image.</li>
<li>The --add-host option now accepts the special string host-gateway instead of an IP Address, which will be mapped to the host IP address.</li>
<li>The podman generate systemd command is deprecated. Use Quadlet for running containers and pods under systemd.</li>
<li>The podman secret rm command now supports an --ignore option.</li>
<li>The --env-file option now supports multiline variables (#18724).</li>
<li>The --read-only-tmpfs flag now affects /dev and /dev/shm as well as /run, /tmp, /var/tmp (#12937).</li>
<li>The Podman --mount option now supports bind mounts passed as globs.</li>
<li>The --mount option can now be specified in containers.conf using the mounts field.</li>
<li>The podman stats now has an --all option to get all containers stats (#19252).</li>
<li>There is now a new --sdnotify=healthy policy where Podman sends the READY message once the container turns healthy (#6160).</li>
<li>Temporary files created when dealing with images in /var/tmp will automatically be cleaned up on reboot.</li>
<li>There is now a new filter option since for podman volume ls and podman volume prune (#19228).</li>
<li>The podman inspect command now has tab-completion support (#18672).</li>
<li>The podman kube play command now has support for the use of reserved annotations in the generated YAML.</li>
<li>The progress bar is now displayed when decompressing a Podman machine image (#19240).</li>
<li>The podman secret inspect command supports a new option --showsecret which will output the actual secret.</li>
<li>The podman secret create now supports a --replace option, which allows you to modify secrets without replacing containers.</li>
<li>The podman login command can now read the secret for a registry from its secret database created with podman secret create (#18667).</li>
<li>The remote Podman client’s podman play kube command now works with the --userns option (#17392).</li>
</ul>
</li>
<li>
<p>Changes</p>
<ul>
<li>The /tmp and /var/tmp inside of a podman kube play will no longer be noexec.</li>
<li>The limit of inotify instances has been bumped from 128 to 524288 for podman machine (#19848).</li>
<li>The podman kube play has been improved to only pull a newer image for the "latest" tag (#19801).</li>
<li>Pulling from an oci transport will use the optional name for naming the image.</li>
<li>The podman info command will always display the existence of the Podman socket.</li>
<li>The echo server example in socket_activation.md has been rewritten to use quadlet instead of podman generate systemd.</li>
<li>Kubernetes support table documentation correctly show volumes support.</li>
<li>The podman auto-update manpage and documentation has been updated and now includes references to Quadlet.</li>
</ul>
</li>
<li>
<p>Quadlet</p>
<ul>
<li>Quadlet now supports setting Ulimit values.</li>
<li>Quadlet now supports setting the PidsLimit option in a container.</li>
<li>Quadlet unit files allow DNS field in Network group and DNS, DNSSearch, and DNSOption field in Container group (#19884).</li>
<li>Quadlet now supports ShmSize option in unit files.</li>
<li>Quadlet now recursively calls in user directories for unit files.</li>
<li>Quadlet now allows the user to set the service working directory relative to the YAML or Unit files (17177).</li>
<li>Quadlet now allows setting user-defined names for Volume and Network units via the VolumeName and NetworkName directives, respectively.</li>
<li>Kube quadlets can now support autoupdate.</li>
</ul>
</li>
<li>
<p>Bugfixes</p>
<ul>
<li>Fixed an issue where containers were being restarted after a podman kill.</li>
<li>Fixed a bug where events could report incorrect healthcheck results (#19237).</li>
<li>Fixed a bug where running a container in a pod didn't fail if volumes or mounts were specified in the containers.conf file.</li>
<li>Fixed a bug where pod cgroup limits were not being honored after a reboot (#19175).</li>
<li>Fixed a bug where podman rm -af could fail to remove containers under some circumstances (#18874).</li>
<li>Fixed a bug in rootless to clamp oom_score_adj to current value if it is too low (#19829).</li>
<li>Fixed a bug where --hostuser was being parsed in base 8 instead of base 10 (#19800).</li>
<li>Fixed a bug where kube down would error when an object did not exist (#19711).</li>
<li>Fixed a bug where containers created via DOCKER API without specifying StopTimeout had StopTimeout defaulting to 0 seconds (#19139).</li>
<li>Fixed a bug in podman exec to set umask to match the container it's execing into (#19713).</li>
<li>Fixed a bug where podman kube play failed to set a container's Umask to the default 0022.</li>
<li>Fixed a bug to automatically reassign Podman's machine ssh port on Windows when it conflicts with in-use system ports (#19554).</li>
<li>Fixed a bug where locales weren't passed to conmon correctly, resulting in a crash if some characters were specified over CLI (containers/common/#272).</li>
<li>Fixed a bug where podman top would sometimes not print the full output (#19504).</li>
<li>Fixed a bug were podman logs --tail could return incorrect lines when the k8s-file logger is used (#19545).</li>
<li>Fixed a bug where podman stop did not ignore cidfile not existing when user specified --ignore flag (#19546).</li>
<li>Fixed a bug where a container with an image volume and an inheri...</li>
</ul>
</li>
<li>
<p>Update to version 4.6.2:</p>
</li>
<li>
<p>Changes</p>
<ul>
<li>Fixed a performance issue when calculating diff sizes in overlay. The podman system df command should see a significant performance improvement (#19467).</li>
</ul>
</li>
<li>
<p>Bugfixes</p>
<ul>
<li>Fixed a bug where containers in a pod would use the pod restart policy over the set container restart policy (#19671).</li>
</ul>
</li>
<li>
<p>API</p>
<ul>
<li>Fixed a bug in the Compat Build endpoint where the pull query parameter did not parse 0/1 as a boolean (#17778).</li>
</ul>
</li>
<li>
<p>Misc</p>
<ul>
<li>Updated the containers/storage library to v1.48.1</li>
</ul>
</li>
<li>
<p>Update to version 4.6.1:</p>
</li>
<li>
<p>Quadlet</p>
<ul>
<li>Quadlet now selects the first Quadlet file found when multiple Quadlets exist with the same name.</li>
</ul>
</li>
<li>
<p>API</p>
<ul>
<li>Fixed a bug in the container kill endpoint to correctly return 409 when a container is not running (#19368).</li>
</ul>
</li>
<li>
<p>Misc</p>
<ul>
<li>Updated Buildah to v1.31.2</li>
<li>Updated the containers/common library to v0.55.3</li>
</ul>
</li>
<li>
<p>Recommend gvisor-tap-vsock, required for <code>podmand machine</code></p>
</li>
<li>
<p>Update to version 4.6.0:</p>
</li>
<li>
<p>Features</p>
<ul>
<li>The podman manifest inspect command now supports the --authfile option, for authentication purposes.</li>
<li>The podman wait command now supports --condition={healthy,unhealthy}, allowing waits on successful health checks.</li>
<li>The podman push command now supports a new option, --compression-level, which specifies the compression level to use (#18939).</li>
<li>The podman machine start command, when run with --log-level=debug, now creates a console window to display the virtual machine while booting.</li>
<li>Podman now supports a new option, --imagestore, which allows images to be stored in a different directory than the graphroot.</li>
<li>The --ip-range option to the podman network create command now accepts a new syntax, <startIP>-<endIP>, which allows more flexibility when limiting the ip range that Podman assigns.</li>
<li>[Tech Preview] A new command, podmansh, has been added, which executes a user shell within a container when the user logs into the system. The container that the users get added to can be defined via a Podman Quadlet file. This feature is currently a Tech Preview which means it's ready for users to try out but changes can be expected in upcoming versions.</li>
<li>The podman network create command supports a new --option, bclim, for the macvlan driver.</li>
<li>The podman network create command now supports adding static routes using the --route option.</li>
<li>The podman network create command supports a new --option, no_default_route for all drivers.</li>
<li>The podman info command now prints network information about the binary path, package version, program version and DNS information (#18443).</li>
<li>The podman info command now displays the number of free locks available, helping to debug lock exhaustion scenarios.</li>
<li>The podman info command now outputs information about pasta, if it exists in helper_binaries_dir or $PATH.</li>
<li>The remote Podman client’s podman build command now accepts Containerfiles that are not in the context directory (#18239).</li>
<li>The remote Podman client’s podman play kube command now supports the --configmap option (#17513).</li>
<li>The podman kube play command now supports multi-doc YAML files for configmap arguments. (#18537).</li>
<li>The podman pod create command now supports a new flag, --restart, which sets the restart policy for all the containers in a pod.</li>
<li>The --format={{.Restarts}} option to the podman ps command now shows the number of times a container has been restarted based on its restart policy.</li>
<li>The --format={{.Restarts}} option to the podman pod ps command now shows the total number of container restarts in a pod.</li>
<li>The podman machine provider can now be specified via the CONTAINERS_MACHINE_PROVIDER environment variable, as well as via the provider field in containers.conf (#17116).</li>
<li>A default list of pasta arguments can now be set in containers.conf via pasta_options.</li>
<li>The podman machine init and podman machine set commands now support a new option, --user-mode-networking, which improves interops with VPN configs that drop traffic from WSL networking, on Windows.</li>
<li>The remote Podman client’s podman push command now supports the --digestfile option (#18216).</li>
<li>Podman now supports a new option, --out, that allows redirection or suppression of STDOUT (#18120).</li>
</ul>
</li>
<li>
<p>Changes</p>
<ul>
<li>When looking up an image by digest, the entire repository of the specified value is now considered. This aligns with Docker's behavior since v20.10.20. Previously, both the repository and the tag was ignored and Podman looked for an image with only a matching digest. Ignoring the name, repository, and tag of the specified value can lead to security issues and is considered harmful.</li>
<li>The podman system service command now emits a warning when binding to a TCP socket. This is not a secure configuration and the Podman team recommends against using it.</li>
<li>The podman top command no longer depends on ps(1) being present in the container image and now uses the one from the host (#19001).</li>
<li>The --filter id=xxx option will now treat xxx as a CID prefix, and not as a regular expression (#18471).</li>
<li>The --filter option now requires multiple --filter flags to specify multiple filters. It will no longer support the comma syntax (--filter label=a,label=b).</li>
<li>The slirp4netns binary for will now be searched for in paths specified by the helper_binaries_dir option in containers.conf (#18239).</li>
<li>Podman machine now updates /run/docker.sock within the guest to be consistent with its rootless/rootful setting (#18480).</li>
<li>The podman system df command now counts files which podman generates for use with specific containers as part of the disk space used by those containers, and which can be reclaimed by removing those containers. It also counts space used by files it associates with specific images and volumes as being used by those images and volumes.</li>
<li>The podman build command now returns a clearer error message when the Containerfile cannot be found. (#16354).</li>
<li>Containers created with --pid=host will no longer print errors on podman stop (#18460).</li>
<li>The podman manifest push command no longer requires a destination to be specified. If a destination is not provided, the source is used as the destination (#18360).</li>
<li>The podman system reset command now warns the user that the graphroot and runroot directories will be deleted (#18349), (#18295).</li>
<li>The package and package-install targets in Makefile have now been fixed and also renamed to rpm and rpm-install respectively for clarity (#18817).</li>
</ul>
</li>
<li>
<p>Quadlet</p>
<ul>
<li>Quadlet now exits with a non-zero exit code when errors are found (#18778).</li>
<li>Rootless podman quadlet files can now be installed in /etc/containers/systemd/users directory.</li>
<li>Quadlet now supports the AutoUpdate option.</li>
<li>Quadlet now supports the Mask and Unmask options.</li>
<li>Quadlet now supports the WorkingDir option, which specifies the default working dir in a container.</li>
<li>Quadlet now supports the Sysctl option, which sets namespaced kernel parameters for containers (#18727).</li>
<li>Quadlet now supports the SecurityLabelNetsted=true option, which allows nested SELinux containers.</li>
<li>Quadlet now supports the Pull option in .container files (#18779).</li>
<li>Quadlet now supports the ExitCode field in .kube files, which reflects the exit codes of failed containers.</li>
<li>Quadlet now supports PodmanArgs field.</li>
<li>Quadlet now supports the HostName field, which sets the container's host name, in .container files (#18486).</li>
</ul>
</li>
<li>
<p>Bugfixes</p>
<ul>
<li>Fixed a bug where the podman machine start command would fail with a 255 exit code. It now waits for systemd-user sessions to be up, and for SSH to be ready, addressing the flaky machine starts (#17403).</li>
<li>Fixed a bug where the podman auto update command did not correctly use authentication files when contacting container registries.</li>
<li>Fixed a bug where --label option to the podman volume ls command would return volumes that matched any of the filters, not all of them (#19219).</li>
<li>Fixed a bug where the podman kube play command did not recognize containerPort names inside Kubernetes liveness probes. Now, liveness probes support both containerPort names as well as port numbers (#18645).</li>
<li>Fixed a bug where the --dns option to the podman run command was ignored for macvlan networks (#19169).</li>
<li>Fixed a bug in the podman system service command where setting LISTEN_FDS when listening on TCP would misbehave.</li>
<li>Fixed a bug where hostnames were not recognized as a network alias. Containers can now resolve other hostnames, in addition to their names (#17370).</li>
<li>Fixed a bug where the podman pod run command would error after a reboot on a non-systemd system (#19175).</li>
<li>Fixed a bug where the --syslog option returned a fatal error when no syslog server was found (#19075).</li>
<li>Fixed a bug where the --mount option would parse the readonly option incorrectly (#18995).</li>
<li>Fixed a bug where hook executables invoked by the podman run command set an incorrect working directory. It now sets the correct working directory pointing to the container bundle directory (#18907).</li>
<li>Fixed a bug where the -device-cgroup-rule option was silently ignored in rootless mode ([#18698](https://github.com/containers/podman/issu...</li>
</ul>
</li>
<li>
<p>Don't unconditionally Obsolete podman-cni-config, ensure clean upgrade path.</p>
</li>
<li>
<p>Prefer Podman's new network stack (netavark) exclusively on ALP</p>
</li>
<li>
<p>Remove unused podman-cni-config subpackage, add systemd</p>
</li>
<li>
<p>Update to version 4.5.1:</p>
</li>
<li>
<p>Security</p>
<ul>
<li>Do not include image annotations when building spec. These annotations can have security implications - crun, for example, allows rootless containers to preserve the user's groups through an annotation.</li>
</ul>
</li>
<li>
<p>Quadlet</p>
<ul>
<li>Fixed a bug in quadlet to recognize the systemd optional prefix '-'.</li>
</ul>
</li>
<li>
<p>Bugfixes</p>
<ul>
<li>Fixed a bug where fully resolving symlink paths included the version number, breaking the path to homebrew-installed qemu files (#18111).</li>
<li>Fixed a bug where Podman was splitting the filter map slightly differently compared to Docker (#18092).</li>
<li>Fixed a bug where running make package did not work on RHEL 8 environments (#18421).</li>
<li>Fixed a bug to allow comma separated dns server IP addresses in podman network create --dns and podman network update --dns-add/--dns-drop (#18663).</li>
<li>Fixed a bug to correctly stop containers created with --restart=always in all cases (#18259).</li>
<li>Fixed a bug in podman-remote logs to correctly display errors reported by the server.</li>
<li>Fixed a bug to correctly tear down the network stack again when an error happened during the setup.</li>
<li>Fixed a bug in the remote API exec inspect call to correctly display updated information, e.g. when the exec process died (#18424).</li>
<li>Fixed a bug so that podman save on windows can now write to stdout by default (#18147).</li>
<li>Fixed a bug where podman machine rm with the qemu backend now correctly removes the machine connection after the confirmation message not before (#18330).</li>
<li>Fixed a problem where podman machine connections would try to connect to the ipv6 localhost ipv6 (::1) (#16470).</li>
</ul>
</li>
<li>
<p>API</p>
<ul>
<li>Fixed a bug in the compat container create endpoint which could result in a "duplicate mount destination" error when the volume path was not "clean", e.g. included a final slash at the end. (#18454).</li>
<li>The compat API now correctly accepts a tag in the images/create?fromSrc endpoint (#18597).</li>
</ul>
</li>
<li>
<p>Update to version 4.5.0:</p>
</li>
<li>
<p>Features</p>
<ul>
<li>The podman kube play command now supports the hostIPC field (#17157).</li>
<li>The podman kube play command now supports a new flag, --wait, that keeps the workload running in foreground until killed with a sigkill or sigterm. The workloads are cleaned up and removed when killed (#14522).</li>
<li>The podman kube generate and podman kube play commands now support SELinux filetype labels.</li>
<li>The podman kube play command now supports sysctl options (#16711).</li>
<li>The podman kube generate command now supports generating the Deployments (#17712).</li>
<li>The podman machine inspect command now shows information about named pipe addresses on Windows (#16860).</li>
<li>The --userns=keep-id option for podman create, run, and kube play now works for root containers by copying the current mapping into a new user namespace (#17337).</li>
<li>A new command has been added, podman secret exists, to verify if a secret with the given name exists.</li>
<li>The podman kube generate and podman kube play commands now support ulimit annotations (#16404).</li>
<li>The podman create, run, pod create, and pod clone commands now support a new option, --shm-size-systemd, that allows limiting tmpfs sizes for systemd-specific mounts (#17037).</li>
<li>The podman create and run commands now support a new option, --group-entry which customizes the entry that is written to the /etc/group file within the container when the --user option is used (#14965).</li>
<li>The podman create and podman run commands now support a new option, --security-opt label=nested, which allows SELinux labeling within a confined container.</li>
<li>A new command, podman machine os apply has been added, which applies OS changes to a Podman machine, from an OCI image.</li>
<li>The podman search command now supports two new options: --cert-dir and --creds.</li>
<li>Defaults for the --cgroup-config option for podman create and podman run can now be set in containers.conf.</li>
<li>Podman now supports auto updates for containers running inside a pod (#17181).</li>
<li>Podman can now use a SQLite database as a backend for increased stability. The default remains the old database, BoltDB. The database to use is selected through the database_backend field in containers.conf.</li>
<li>Netavark plugin support has been added. The netavark network backend now allows users to create custom network drivers. podman network create -d <plugin> can be used to create a network config for your plugin and then Podman will use it like any other config and takes care of setup/teardown on container start/stop. This requires at least Netavark version 1.6.</li>
<li>DHCP with macvlan and the netavark backend is now supported.</li>
</ul>
</li>
<li>
<p>Changes</p>
<ul>
<li>Remote builds using the podman build command no longer allows .containerignore or .dockerignore files to be symlinks outside the build context.</li>
<li>The podman system reset command now clears build caches.</li>
<li>The podman play kube command now adds ctrName as an alias to the pod network (#16544).</li>
<li>The podman kube generate command no longer adds hostPort to the pod spec when generating service kinds.</li>
<li>Using a private cgroup namespace with systemd containers on a cgroups v1 system will explicitly error (this configuration has never worked) (#17727).</li>
<li>The SYS_CHROOT capability has been re-added to the default set of capabilities.</li>
<li>Listing large quantities of images with the podman images command has seen a significant performance improvement (#17828).</li>
</ul>
</li>
<li>
<p>Quadlet</p>
<ul>
<li>Quadlet now supports the Rootfs= option, allowing containers to be based on rootfs in addition to image.</li>
<li>Quadlet now supports the Secret key in the Container group.</li>
<li>Quadlet now supports the Logdriver key in .container and .kube units.</li>
<li>Quadlet now supports the Mount key in .container files (#17632).</li>
<li>Quadlet now supports specifying static IPv4 and IPv6 addresses in .container files via the IP= and IP6= options.</li>
<li>Quadlet now supports health check configuration in .container files.</li>
<li>Quadlet now supports relative paths in the Volume key in .container files (#17418).</li>
<li>Quadlet now supports setting the UID and GID options for --userns=keep-id (#17908).</li>
<li>Quadlet now supports adding tmpfs filesystems through the Tmpfs key in .container files (#17907).</li>
<li>Quadlet now supports the UserNS option in .container files, which will replace the existing RemapGid, RemapUid, RemapUidSize and RemapUsers options in a future release (#17984).</li>
<li>Quadlet now includes a --version option.</li>
<li>Quadlet now forbids specifying SELinux label types, including disabling selinux separation.</li>
<li>Quadlet now does not set log-driver by default.</li>
<li>Fixed a bug where Quadlet did not recognize paths starting with systemd specifiers as absolute (#17906).</li>
</ul>
</li>
<li>
<p>Bugfixes</p>
<ul>
<li>Fixed a bug in the network list API where a race condition would cause the list to fail if a container had just been removed (#17341).</li>
<li>Fixed a bug in the podman image scp command to correctly use identity settings.</li>
<li>Fixed a bug in the remote Podman client's podman build command where building from stdin would fail. podman --remote build -f - now works correctly (#17495).</li>
<li>Fixed a bug in the podman volume prune command where exclusive (!=) filters would fail (#17051).</li>
<li>Fixed a bug in the --volume option in the podman create, run, pod create, and pod clone commands where specifying relative mappings or idmapped mounts would fail (#17517).</li>
<li>Fixed a bug in the podman kube play command where a secret would be created, but nothing would be printed on the terminal (#17071).</li>
<li>Fixed a bug in the podman kube down command where secrets were not removed.</li>
<li>Fixed a bug where cleaning up after an exited container could segfault on non-Linux operating systems.</li>
<li>Fixed a bug where the podman inspect command did not properly list the network configuration of containers created with --net=none or --net=host (#17385).</li>
<li>Fixed a bug where containers created with user-specified SELinux labels that created anonymous or named volumes would create those volumes with incorrect labels.</li>
<li>Fixed a bug where the podman checkpoint restore command could panic.</li>
<li>Fixed a bug in the podman events command where events could be returned more than once after a log file rotation (#17665).</li>
<li>Fixed a bug where errors from systemd when restarting units during a podman auto-update command were not reported.</li>
<li>Fixed a bug where containers created with the --health-on-failure=restart option were not restarting when the health state turned unhealthy (#17777).</li>
<li>Fixed a bug where containers using the slirp4netns network mode with the cidr option and a custom user namespace did not set proper DNS IPs in resolv.conf.</li>
<li>Fixed a bug where the podman auto-update command could fail to restart systemd units (#17607).</li>
<li>Fixed a bug where the podman play kube command did not properly handle secret.items in volumes (#17829).</li>
<li>Fixed a bug where the podman generate kube command could generate pods with invalid names and hostnames (#18054).</li>
<li>Fixed a bug where names of limits (such as RLIMIT_NOFILE) passed to the --ulimit option to podman create and podman run were case-sensitive (#18077).</li>
<li>Fixed a possible corruption issue with the configuration state of podman machine during system failures on Mac, Linux, and Windows.</li>
</ul>
</li>
<li>
<p>API</p>
<ul>
<li>The Compat Stats endpoint for Containers now returns the Id key as lowercase id to match Docker (#17869).</li>
<li>Fixed a bug where the Compat top endpoint incorrectly returned titles as a string instead of a list (#17524).</li>
</ul>
</li>
<li>
<p>Misc</p>
<ul>
<li>The podman version command no longer joins the rootless user namespace (#17657).</li>
<li>The podman-events --stream option is no longer hidden and is now documented.</li>
<li>Updated Buildah to v1.30.0</li>
<li>Updated the containers/storage library to v1.46.1</li>
<li>Updated the containers/image library to v5.25.0</li>
<li>Updated the containers/common library to v0.52.0</li>
</ul>
</li>
<li>
<p>Don't build against EoL go versions, fixes bsc#1210299</p>
</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
openSUSE Leap 15.5
<br/>
<code>zypper in -t patch SUSE-2023-4628=1 openSUSE-SLE-15.5-2023-4628=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Micro 5.5
<br/>
<code>zypper in -t patch SUSE-SLE-Micro-5.5-2023-4628=1</code>
</li>
<li class="list-group-item">
Containers Module 15-SP5
<br/>
<code>zypper in -t patch SUSE-SLE-Module-Containers-15-SP5-2023-4628=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)
<ul>
<li>podman-4.7.2-150500.3.3.1</li>
<li>podmansh-4.7.2-150500.3.3.1</li>
<li>podman-remote-debuginfo-4.7.2-150500.3.3.1</li>
<li>podman-debuginfo-4.7.2-150500.3.3.1</li>
<li>podman-remote-4.7.2-150500.3.3.1</li>
</ul>
</li>
<li>
openSUSE Leap 15.5 (noarch)
<ul>
<li>podman-docker-4.7.2-150500.3.3.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Micro 5.5 (aarch64 s390x x86_64)
<ul>
<li>podman-4.7.2-150500.3.3.1</li>
<li>podmansh-4.7.2-150500.3.3.1</li>
<li>podman-remote-debuginfo-4.7.2-150500.3.3.1</li>
<li>podman-debuginfo-4.7.2-150500.3.3.1</li>
<li>podman-remote-4.7.2-150500.3.3.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Micro 5.5 (noarch)
<ul>
<li>podman-docker-4.7.2-150500.3.3.1</li>
</ul>
</li>
<li>
Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64)
<ul>
<li>podman-4.7.2-150500.3.3.1</li>
<li>podmansh-4.7.2-150500.3.3.1</li>
<li>podman-remote-debuginfo-4.7.2-150500.3.3.1</li>
<li>podman-debuginfo-4.7.2-150500.3.3.1</li>
<li>podman-remote-4.7.2-150500.3.3.1</li>
</ul>
</li>
<li>
Containers Module 15-SP5 (noarch)
<ul>
<li>podman-docker-4.7.2-150500.3.3.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1210299">https://bugzilla.suse.com/show_bug.cgi?id=1210299</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1215807">https://bugzilla.suse.com/show_bug.cgi?id=1215807</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1215926">https://bugzilla.suse.com/show_bug.cgi?id=1215926</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-7287">https://jira.suse.com/browse/PED-7287</a>
</li>
</ul>
</div>