What podman-container-tools/podman shipped
Written by FoxPlug from the repository's own releases; not affiliated with Podman. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/podman-container-tools/podman; Podman did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of October 5, 2026
What shipped
- Podman kube play gained a -l/--label flag that applies user-provided labels to pods, PVCs and secrets created from Kubernetes YAML. Pull request #27481
- Readiness for the gvproxy socket now uses a notify socket and a JSON ready message instead of backoff polling, removing a race condition. Pull request #29048
- When the default OCI runtime fails to initialize, Podman now reports the underlying reason instead of only saying the runtime was not found. Pull request #29930
- Quadlet can now discover template instances from drop-in directories, so an explicit instance file or symlink is no longer required just to override directives. Pull request #29839
- An unlimited pids limit is dropped for rootless cgroupfs setups so crun no longer fails with controller pids is not available. Pull request #29910
- Volume state is now saved when a mount is absent, fixing inspect output for volumes created with bind options. Pull request #29904
- Volume export now delays unmounting until the returned stream is closed, avoiding truncated reads. Pull request #29636
- Exporting keep-id containers now preserves file ownership. Pull request #29899
- Volume plugin initialization is now lazy, so unrelated volume commands no longer log plugin socket errors after a reboot. Pull request #28877
- System dial-stdio now also quits when the current context is done. Pull request #29923
Why it matters
This week covers several fixes that users feel directly: better error reporting when the default OCI runtime cannot start, kube play labels, and ownership and export fixes for volumes and containers. Machine and rootless users on cgroupfs also get fixes that stop pids controller failures on WSL. Quadlet users can now override a few directives without creating an instance file first.
Changelog entry
- Podman kube play: add -l/--label to set labels on pods, PVCs and secrets created from Kubernetes YAML. Pull request #27481
- Use the gvproxy notify socket and a JSON ready message instead of polling for socket readiness. Pull request #29048
- Report the underlying reason when the default OCI runtime fails to initialize. Pull request #29930
- Quadlet: discover template instances from drop-in directories. Pull request #29839
- Omit an unlimited pids limit for rootless cgroupfs to avoid crun pids controller failures. Pull request #29910
- Save volume state when the mount is absent. Pull request #29904
- Delay volume unmount in Export until the returned stream is closed. Pull request #29636
- Preserve ownership when exporting keep-id containers. Pull request #29899
- Make volume plugin initialization lazy so unrelated commands do not log socket errors after reboot. Pull request #28877
- System dial-stdio now quits when the current context is done. Pull request #29923
- Compat stats: fix
system_cpu_usage,precpu_stats, one-shot CPU percentage and docs. Pull request #29599 - Bump the bundled gvproxy in the Podman installers to 0.9.0. Pull request #29933
This week: kube play --label for pods, PVCs and secrets; clearer errors when the default OCI runtime fails; gvproxy readiness via notify socket; Quadlet template instances from drop-in directories; volume export and keep-id ownership fixes.
This week in Podman: podman kube play accepts a --label flag that applies labels to pods, PVCs and secrets created from Kubernetes YAML. Failures to initialize the default OCI runtime now report the real cause instead of only a not-found message. Readiness for gvproxy uses a notify socket with a JSON ready message instead of polling, which removes a race. Quadlet discovers template instances from drop-in directories, so overrides no longer require an explicit instance file. Rootless cgroupfs setups no longer pass an unlimited pids limit that crun rejects. Volume state is saved when a mount is absent, volume export waits for the stream to close, and exporting keep-id containers preserves ownership.
Week of September 28, 2026
What shipped
- V5.8.8 released, addressing CVE-2026-94603 where checkpoint images could disable sandboxing. Release
- V6.1.3 released, addressing CVE-2026-94603 where checkpoint images could disable sandboxing. Release
- Podman ps now allows sorting by pod, completing the --sort flag's pod option support. Pull request #29637
- Podman cp now honors volume subpath configuration when copying from containers. Pull request #29842
- Fixed podman ps label lookup in table headings when using custom format templates. Pull request #29844
- Events dispatched to journald now omit redundant timestamps since journald records them natively. Pull request #29868
- Podman machine --import-native-ca now properly quotes paths containing spaces or special characters. Pull request #29853
- Compat API now ignores dead and restarting status filters instead of returning HTTP 500. Pull request #29366
- Fixed handling of ESRCH errors from openByHandleAt in exec session retrieval. Pull request #29851
- Rootless pause process now clears environment before spawning to prevent variable buffer overflow. Pull request #29657
Why it matters
Two security releases address CVE-2026-94603 affecting checkpoint image handling. Several bug fixes improve core functionality in container operations, volume handling, and API compatibility. Infrastructure improvements ensure better test coverage and platform support.
Changelog entry
- Podman ps: pod sort option is now accepted by --sort flag Pull request #29637
- Podman cp: volume subpath configuration is now honored when copying from containers Pull request #29842
- Events: redundant timestamps removed from journald log output Pull request #29868
- Podman machine: native CA certificate import now handles paths with spaces and special characters Pull request #29853
- Fixed ESRCH error handling in exec session retrieval Pull request #29851
- Podman ps: label lookup in custom format templates now works correctly Pull request #29844
- Compat API: dead and restarting status filters are now ignored gracefully Pull request #29366
- Rootless: pause process environment cleared to prevent buffer overflow Pull request #29657
V5.8.8 and v6.1.3 released with CVE-2026-94603 fix. New features: podman ps pod sorting, cp volume subpath support. Various fixes for label lookup, journald timestamps, and path quoting.
Podman releases v5.8.8 and v6.1.3 address security vulnerability CVE-2026-94603. This week's updates include new sorting capability for pods in podman ps, improved volume subpath handling in podman cp, fixes for table formatting with custom labels, and better cross-platform compatibility. Infrastructure improvements enhance test coverage and path handling robustness.
Week of September 21, 2026
What shipped
- Podman container inspect now exposes IsInitCtr and InitContainerType fields to distinguish init containers from regular containers. Pull request #29818
- PidsLimit 0 is now normalized to unlimited for runc to match Docker behavior across native CLI, compat API, and kube play. Pull request #29827
- The compat API now accepts inline seccomp profiles in HostConfig.SecurityOpt to support Docker clients that send profile JSON directly. Pull request #29726
- Auto-update now supports container filters through CLI, remote bindings, and REST API to selectively update container groups. Pull request #29791
- Rootless quadlet generation now correctly discovers drop-in directories for symlinked rootful quadlets. Pull request #29825
- The cgroup check was moved after help, completion, and subcommand checks to fix podman completion failures in sandboxed environments. Pull request #29832
- The ConsoleSize field in podman inspect now returns the actual TTY size for running containers with terminal enabled. Pull request #28579
- Exec can now be run with no attach streams requested to match Docker's detached exec behavior. Pull request #28686
- The compat API GET /images/{id}/json endpoint now omits the Created field when empty to match Docker API v1.44 behavior. Pull request #29761
- The compat distribution inspect endpoint has been implemented to fix a missing Docker API compatibility feature. Pull request #28358
Why it matters
This week brings several Docker compatibility fixes that improve interoperability with Docker clients and tooling. Init container inspection, seccomp profile handling, and PidsLimit normalization resolve real-world usage issues. Container filtering in auto-update enables more precise deployment workflows.
Changelog entry
- Inspect: expose init container information with IsInitCtr and InitContainerType fields Pull request #29818
- Compat: map pids-limit 0 to unlimited for runc consistency Pull request #29827
- Compat API: accept inline seccomp profiles from Docker clients Pull request #29726
- Auto-update: add container filters via CLI, remote bindings, and REST API Pull request #29791
- Quadlet: resolve symlinks to find drop-ins in target unit directory Pull request #29825
- Move cgroup check below help/completion/subcommands check for sandboxed environments Pull request #29832
- Fix: return actual tty size in
container_inspectConsoleSize field Pull request #28579 - Allow running exec with no attach streams requested for Docker compat Pull request #28686
- Compat: omit empty Created field from GET /images/{id}/json Pull request #29761
- Api: implement compat distribution inspect endpoint Pull request #28358
This week: init container inspection, Docker seccomp profile support, PidsLimit normalization, auto-update filters, quadlet symlink fixes, and more compat API improvements.
Podman shipped container inspection enhancements, improved Docker compatibility for seccomp profiles and exec operations, auto-update filtering for selective container updates, fixes for rootless quadlet symlinks, and standardized PidsLimit behavior. These changes strengthen Docker interoperability and support more sophisticated deployment scenarios.
Week of September 14, 2026
What shipped
- Podman 5.8.7 released with security fixes for CVE-2025-11395 addressing crafted layer tarballs in podman load and symlinks in podman volume import that could overwrite host files. Release
- Podman 6.1.2 released with security fixes for CVE-2025-11395 and related vulnerabilities. Release
- Podman image scp now supports --compression-format and --compression-level options to compress archives during transfer, supporting gzip and zstd formats. Pull request #29395
- New libpod REST API endpoint for autoupdate functionality added, matching the capabilities of the CLI version. Pull request #27025
- Fixed compat container update to preserve existing restart policy unless explicitly overridden in the request. Pull request #29795
- Docker-compat network API now includes the IPRange field in IPAM config, mapping from Libpod's LeaseRange. Pull request #28633
- Podman exec now forwards signals to the exec session's process group, preventing commands from continuing to run after exec is killed. Pull request #29525
- Health check command behavior fixed to use the health check command for startup health checks when --health-startup-cmd is not present, matching Docker behavior. Pull request #27857
- Documentation added explaining rootless bind-mount access through unmapped parent directories and user namespace ID mapping. Pull request #29375
- CPU real-time scheduler options --cpu-rt-period and --cpu-rt-runtime are now hidden and marked as no-ops since Podman 6 dropped cgroups v1 support. Pull request #29784
Why it matters
Two security releases address a critical vulnerability in image and volume import operations that could overwrite host files. Several improvements enhance container compatibility with Docker APIs and add new features for remote image transfer and API functionality.
Changelog entry
- Security: v5.8.7 released addressing CVE-2025-11395 for crafted layer tarballs and symlinks Release
- Security: v6.1.2 released addressing CVE-2025-11395 and related vulnerabilities Release
- Feature: podman image scp adds --compression-format and --compression-level options Pull request #29395
- Feature: New libpod REST API endpoint for autoupdate functionality Pull request #27025
- Fix: Compat container update preserves restart policy unless explicitly changed Pull request #29795
- Fix: Docker-compat network API includes IPRange field in IPAM config Pull request #28633
- Fix: podman exec now forwards signals to the exec session's process group Pull request #29525
- Fix: Health check command used for startup checks when --health-startup-cmd not set Pull request #27857
- Fix: Compat reports cgroup driver 'none' for rootless with cgroupfs Pull request #29303
- Change: --cpu-rt-period and --cpu-rt-runtime hidden and marked as no-ops Pull request #29784
Podman 5.8.7 and 6.1.2 released with security fixes for CVE-2025-11395. New features include compression for image scp, autoupdate REST API endpoint, and improved Docker API compatibility.
This week brings two security releases addressing CVE-2025-11395 affecting image and volume imports. New features include compression options for podman image scp transfers, an autoupdate endpoint in the libpod REST API, improved Docker API compatibility for networks and container updates, fixed signal forwarding in exec sessions, and better health check behavior matching Docker standards.