What podman-container-tools/podman shipped
Written by FoxPlug from the repository's own releases; not affiliated with Podman. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/podman-container-tools/podman; Podman did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.
Get a weekly update like this for your product, free
Week of November 2, 2026
What shipped
- Checkpoint and restore now works with gVisor, which uses its own checkpoint mechanism instead of CRIU. Pull request #27528
- Podman update now rolls back container config when the runtime rejects a limit, and skips no-op pids updates that failed under rootless cgroupfs. Pull request #30109
- Podman build --remote gains support for the --output flag, streaming a built rootfs as a tar from server to client. Pull request #29767
- Kube play accepts --platform to select the image platform for played workloads. Pull request #29887
- Read-only volume mounts now apply the ro option to virtiofs and 9p shares in machine VMs, so guests no longer get writable mounts. Pull request #29898
- Tmpfs mounts now accept uid and gid options, which previously failed with an unknown mount option error. Pull request #29987
- Container creation now honors the containers.conf init default when the option is omitted, while explicit values still win and infra containers stay excluded. Pull request #30097
- Image scp now works when started from a working directory the destination user cannot access. Pull request #29942
- The --subgidname and --subuidname flags now populate the correct fields, and a regression test was added. Pull request #30072
- The compatible API now rejects secret-create requests that are missing a name or data. Pull request #30075
Why it matters
This week brought checkpoint and restore support for gVisor, a new --output path for remote builds, and --platform for kube play. Several fixes address correctness issues users hit in practice: rejected update limits that could leave containers unable to start, read-only volume mounts that were writable in VMs, and swapped subuid and subgid flags.
Changelog entry
- Support checkpoint and restore with gVisor, which does not use CRIU. Pull request #27528
- Add --output to podman build --remote, streaming the rootfs as a tar. Pull request #29767
- Add --platform to kube play for selecting the image platform. Pull request #29887
- Roll back container config when a runtime update fails, and skip no-op pids updates. Pull request #30109
- Apply the ro mount option to virtiofs and 9p shares in machine VMs. Pull request #29898
- Allow uid and gid options on tmpfs mounts. Pull request #29987
- Honor the containers.conf init default when creating containers. Pull request #30097
- Fix image scp from working directories the destination user cannot access. Pull request #29942
- Fix swapped --subuidname and --subgidname field mappings. Pull request #30072
- Reject secret-create requests missing name or data in the compatible API. Pull request #30075
- Expose masked and readonly paths in inspect. Pull request #30123
- Scope Quadlet user units to their directory. Pull request #30120
This week: checkpoint/restore with gVisor, --output for podman build --remote, and --platform for kube play. Also fixed: podman update rejecting limits without rollback, read-only mounts on virtiofs/9p becoming writable, and swapped subuid/subgid flags.
Recent Podman changes include checkpoint and restore support with gVisor, which uses its own checkpoint mechanism rather than CRIU, --output support for podman build --remote, and a --platform flag for kube play. Fixes this week cover podman update rolling back config when the runtime rejects a limit and skipping no-op pids updates, read-only volume mounts now applying the ro option to virtiofs and 9p shares in machine VMs, uid and gid options on tmpfs mounts, containers.conf init defaults being honored on container creation, image scp working from inaccessible working directories, a swap in the --subuidname and --subgidname flag mappings, and rejection of secret-create requests missing name or data.
Week of October 26, 2026
What shipped
- Released v6.2.0-RC1, adding a --platform option to podman push for selecting a single platform manifest and a --validate option to podman kube play for controlling how unrecognized YAML fields are handled. Release
- Added a --pidfile flag to podman start so a container's main process PID can be read from a path chosen at each start. Pull request #28983
- Exposed conmon log rotation options through --log-opt max-file and log-rotate and through the REST API. Pull request #29632
- Added next-exit, not-running and removed wait conditions to podman wait so containers that were never started can be distinguished. Pull request #28976
- Switched the SQLite state backend to WAL mode to avoid database corruption under heavy container churn. Pull request #29733
- Stopped passing LISTEN_ environment variables to conmon when podman is socket-activated. Pull request #30057
- Made the Docker-compatible container API honor the selected runtime, show it in inspect output and return 400 for unavailable runtimes instead of silently falling back. Pull request #30082
- Fixed remote builds so the client's default seccomp profile path is no longer sent to the server. Pull request #29337
- Fixed HEALTHCHECK NONE still creating systemd healthcheck timers. Pull request #30043
- Added the ability to rewrite database cached paths without removing the database with podman system reset. Pull request #30055
Why it matters
This week brings a release candidate with new push and kube play options, plus several fixes for everyday pain points: a fresh pidfile per start, clearer wait conditions for containers that never ran, and a state database change aimed at preventing corruption under heavy churn. Remote builds and the Docker-compatible API also get more predictable behavior.
Changelog entry
- Release v6.2.0-RC1 with podman push --platform and podman kube play --validate. Release
- Podman start now accepts --pidfile to set the PID file path at start time. Pull request #28983
- --log-opt max-file and log-rotate plus REST API options now expose conmon log rotation. Pull request #29632
- Podman wait adds next-exit, not-running and removed conditions. Pull request #28976
- The libpod SQLite state backend now uses WAL mode. Pull request #29733
- LISTEN_ environment variables are no longer passed to conmon when socket-activated. Pull request #30057
- The Docker-compatible container API honors the selected runtime and returns 400 for unavailable ones. Pull request #30082
- Remote builds no longer send the client's default seccomp profile path to the server. Pull request #29337
- HEALTHCHECK NONE no longer creates systemd healthcheck timers. Pull request #30043
- Database cached paths can now be rewritten without podman system reset. Pull request #30055
- Quadlet rootless generator now translates dependencies on rootful templated units. Pull request #29920
- Podman kube down now prints errors when secret removal fails. Pull request #30012
Podman v6.2.0-RC1 is out: podman push gains --platform to push a single manifest, and podman kube play gains --validate. Also this week: --pidfile on podman start, log rotation via --log-opt, new wait conditions, and a SQLite WAL switch.
Podman v6.2.0-RC1 is available. podman push now takes --platform to push a single platform-specific manifest instead of the whole list, and podman kube play takes --validate to control how unrecognized YAML fields are handled. Other changes this week: podman start accepts --pidfile so a fresh path can be chosen per start; conmon log rotation is exposed through --log-opt max-file and log-rotate and the REST API; podman wait gains next-exit, not-running and removed conditions; the SQLite state backend moves to WAL mode to avoid corruption under heavy container churn; and the Docker-compatible API now honors the selected runtime instead of silently falling back.
Week of October 19, 2026
What shipped
- Podman machine info now reports the running machine's vmtype instead of always using the system default provider. Pull request #29997
- Podman ps now accepts negated status filters such as status!=value, and status! counts as an explicit filter without --all. Pull request #29888
- On Windows, a stale API socket left by win-sshproxy is now deleted before the proxy starts, so podman machine start no longer leaves the API unavailable. Pull request #30007
- Podman events with an --until time in the past now returns the historical events in that window instead of dropping them. Pull request #29896
- Podman manifest annotate --os-features now saves the OS features so they show up in manifest inspect, for local and remote Podman. Pull request #29990
- The checkpoint log path is now kept on failure so inspect can report the log after a failed checkpoint. Pull request #30018
- Podman update now rejects adding a startup healthcheck to a container that has no regular healthcheck, preventing a later crash. Pull request #30008
- Remote secret removal no longer removes a secret after an inspect fails with an error other than not found. Pull request #30011
- Removing a pod now skips volumes that are already gone instead of reporting an error. Pull request #30010
- Podman cp now resolves subpaths correctly when copying from an image mount into a container that is created but not started. Pull request #29894
Why it matters
This week brought fixes across machines, filtering, events, manifests and remote operations, many of them closing long-standing issues. Users on Windows get a more reliable machine API after host restarts, and command-line behavior like status filters and past --until windows is now more predictable. Documentation for kube play and proxy defaults was also clarified.
Changelog entry
- Podman machine info now reports the current machine's vmtype rather than the system default provider's. Pull request #29997
- Podman ps accepts negated status filters such as status!=value. Pull request #29888
- Podman events no longer drops historical events when --until is in the past. Pull request #29896
- Windows: remove a stale API socket before starting the proxy so the machine API comes back after a host restart. Pull request #30007
- Manifest annotate --os-features now persists the OS features, including with --remote. Pull request #29990
- Preserve the checkpoint log path on failure so inspect can report it. Pull request #30018
- Podman update rejects a startup healthcheck when the container has no regular healthcheck. Pull request #30008
- Remote secret removal no longer removes a secret after a failed inspect. Pull request #30011
- Pod removal skips volumes that are already gone. Pull request #30010
- Podman cp resolves subpaths correctly from an image mount in created but not started containers. Pull request #29894
- Verify the volume mountpoint before incrementing the mount count for filesystem-backed volumes. Pull request #29917
- Clarify kube play documentation on how image names are matched to directories. Pull request #30017
This week: podman machine info reports the running machine's vmtype, ps takes status!= filters, events with a past --until returns history, and Windows machines get past a stale API socket. Plus fixes for manifest --os-features, checkpoints, secrets and more.
This week's Podman changes include several fixes that make day-to-day use more predictable. podman machine info now reports the running machine's vmtype instead of the system default, podman ps accepts negated status filters, and podman events with an --until time in the past returns the events in that window rather than dropping them. On Windows, a stale API socket is removed before the proxy starts, so podman machine start keeps the API available after a host restart. Other fixes cover manifest annotate --os-features not being saved, checkpoint log paths after a failure, startup healthchecks added through podman update, remote secret removal, pod removal with missing volumes, and podman cp from image mount subpaths. Documentation for kube play and proxy defaults was clarified too.
Week of October 12, 2026
What shipped
- Released v6.1.4, which fixes Podman not functioning under WSL 3 and updates gvproxy to v0.9.0 to resolve a CVE, along with Buildah v1.45.2 and Storage v1.64.2. Release
- Released v5.8.9, which fixes Podman under WSL 3, fixes podman machine VMs on Mac being left in an inconsistent state when podman machine start is interrupted by a signal, and updates gvproxy to v0.9.0 for a CVE. Release
- Changed CI so Fedora Rawhide jobs install conmon-v3 and point containers.conf and CONMON_BINARY at it, testing the new conmon-v3 binary. Pull request #29770
- Clarified the --runtime-flag documentation to note it can be given multiple times inline and that setting it makes Podman ignore runtime flags from containers.conf. Pull request #29983
- Added a Quadlet SetMountsDependency setting to choose RequiresMountsFor, WantsMountsFor, or no generated dependency for user mount source paths, keeping Requires as the default. Pull request #29949
- Added a CI workflow running actionlint on GitHub Actions workflow files with shellcheck on embedded shell scripts, and fixed the issues found. Pull request #29889
- Changed pkg/systemd so the dbus code is not compiled for remote or non-Linux builds. Pull request #29972
- Fixed zizmor warnings, silencing the
pull_request_targetwarning where it is needed. Pull request #29967 - Bumped the bundled gvproxy version to v0.9.0 on the v5.8 branch. Pull request #29948
- Updated gvproxy to 0.9.0 on the v6.1 branch to pick up the latest fixes, bumping the version in the podman installers. Pull request #29934
Why it matters
This week brought bugfix releases on both maintained branches, including a WSL 3 fix and an updated gvproxy that resolves a CVE. The Mac machine start fix removes a way for machines to be left in an inconsistent state. On the development side, Quadlet gained configurable mount dependencies and CI now tests conmon-v3 on Rawhide and runs actionlint on the workflow files.
Changelog entry
- Release v6.1.4: fixed Podman under WSL 3, updated gvproxy to v0.9.0 for a CVE, Buildah to v1.45.2 and Storage to v1.64.2. Release
- Release v5.8.9: fixed Podman under WSL 3, fixed podman machine VMs on Mac left inconsistent after an interrupted start, updated gvproxy to v0.9.0. Release
- CI: Fedora Rawhide jobs install conmon-v3 and use it via containers.conf and CONMON_BINARY. Pull request #29770
- Docs: --runtime-flag can be given multiple times inline and causes containers.conf runtime flags to be ignored. Pull request #29983
- Quadlet: added SetMountsDependency to pick RequiresMountsFor, WantsMountsFor or no dependency for user mount source paths. Pull request #29949
- CI: added actionlint on GitHub Actions workflows with shellcheck on embedded scripts, and fixed found issues. Pull request #29889
- Pkg/systemd: dbus code no longer compiled for remote or non-Linux builds. Pull request #29972
- Fixed zizmor warnings;
pull_request_targetwarning silenced where required. Pull request #29967 - V5.8: bumped bundled gvproxy to v0.9.0. Pull request #29948
- V6.1: updated gvproxy to 0.9.0, bumping the version in the podman installers. Pull request #29934
Podman v6.1.4 and v5.8.9 are out: WSL 3 fix, gvproxy v0.9.0 for a CVE, and a fix for podman machine VMs on Mac left inconsistent when start is interrupted. Also: Quadlet mount dependency setting, conmon-v3 CI on Rawhide, and actionlint for workflows.
Podman v6.1.4 and v5.8.9 are released. Both fix Podman not working under WSL 3 and update gvproxy to v0.9.0, resolving a CVE; v6.1.4 also brings Buildah v1.45.2 and Storage v1.64.2. v5.8.9 additionally fixes podman machine VMs on Mac being left in an inconsistent state when podman machine start is interrupted by a signal. Other changes this week: Quadlet gains a setting to choose the mount dependency for user mount source paths, with Requires still the default; CI Fedora Rawhide jobs now test conmon-v3; the --runtime-flag docs clarify inline repetition and that it overrides containers.conf runtime flags; and a new workflow runs actionlint and shellcheck on GitHub Actions files.
Week of October 5, 2026
What shipped
- Podman kube play gained a -l/--label flag that applies user-provided labels to pods, PVCs and secrets created from Kubernetes YAML. Pull request #27481
- Readiness for the gvproxy socket now uses a notify socket and a JSON ready message instead of backoff polling, removing a race condition. Pull request #29048
- When the default OCI runtime fails to initialize, Podman now reports the underlying reason instead of only saying the runtime was not found. Pull request #29930
- Quadlet can now discover template instances from drop-in directories, so an explicit instance file or symlink is no longer required just to override directives. Pull request #29839
- An unlimited pids limit is dropped for rootless cgroupfs setups so crun no longer fails with controller pids is not available. Pull request #29910
- Volume state is now saved when a mount is absent, fixing inspect output for volumes created with bind options. Pull request #29904
- Volume export now delays unmounting until the returned stream is closed, avoiding truncated reads. Pull request #29636
- Exporting keep-id containers now preserves file ownership. Pull request #29899
- Volume plugin initialization is now lazy, so unrelated volume commands no longer log plugin socket errors after a reboot. Pull request #28877
- System dial-stdio now also quits when the current context is done. Pull request #29923
Why it matters
This week covers several fixes that users feel directly: better error reporting when the default OCI runtime cannot start, kube play labels, and ownership and export fixes for volumes and containers. Machine and rootless users on cgroupfs also get fixes that stop pids controller failures on WSL. Quadlet users can now override a few directives without creating an instance file first.
Changelog entry
- Podman kube play: add -l/--label to set labels on pods, PVCs and secrets created from Kubernetes YAML. Pull request #27481
- Use the gvproxy notify socket and a JSON ready message instead of polling for socket readiness. Pull request #29048
- Report the underlying reason when the default OCI runtime fails to initialize. Pull request #29930
- Quadlet: discover template instances from drop-in directories. Pull request #29839
- Omit an unlimited pids limit for rootless cgroupfs to avoid crun pids controller failures. Pull request #29910
- Save volume state when the mount is absent. Pull request #29904
- Delay volume unmount in Export until the returned stream is closed. Pull request #29636
- Preserve ownership when exporting keep-id containers. Pull request #29899
- Make volume plugin initialization lazy so unrelated commands do not log socket errors after reboot. Pull request #28877
- System dial-stdio now quits when the current context is done. Pull request #29923
- Compat stats: fix
system_cpu_usage,precpu_stats, one-shot CPU percentage and docs. Pull request #29599 - Bump the bundled gvproxy in the Podman installers to 0.9.0. Pull request #29933
This week: kube play --label for pods, PVCs and secrets; clearer errors when the default OCI runtime fails; gvproxy readiness via notify socket; Quadlet template instances from drop-in directories; volume export and keep-id ownership fixes.
This week in Podman: podman kube play accepts a --label flag that applies labels to pods, PVCs and secrets created from Kubernetes YAML. Failures to initialize the default OCI runtime now report the real cause instead of only a not-found message. Readiness for gvproxy uses a notify socket with a JSON ready message instead of polling, which removes a race. Quadlet discovers template instances from drop-in directories, so overrides no longer require an explicit instance file. Rootless cgroupfs setups no longer pass an unlimited pids limit that crun rejects. Volume state is saved when a mount is absent, volume export waits for the stream to close, and exporting keep-id containers preserves ownership.
Week of September 28, 2026
What shipped
- V5.8.8 released, addressing CVE-2026-94603 where checkpoint images could disable sandboxing. Release
- V6.1.3 released, addressing CVE-2026-94603 where checkpoint images could disable sandboxing. Release
- Podman ps now allows sorting by pod, completing the --sort flag's pod option support. Pull request #29637
- Podman cp now honors volume subpath configuration when copying from containers. Pull request #29842
- Fixed podman ps label lookup in table headings when using custom format templates. Pull request #29844
- Events dispatched to journald now omit redundant timestamps since journald records them natively. Pull request #29868
- Podman machine --import-native-ca now properly quotes paths containing spaces or special characters. Pull request #29853
- Compat API now ignores dead and restarting status filters instead of returning HTTP 500. Pull request #29366
- Fixed handling of ESRCH errors from openByHandleAt in exec session retrieval. Pull request #29851
- Rootless pause process now clears environment before spawning to prevent variable buffer overflow. Pull request #29657
Why it matters
Two security releases address CVE-2026-94603 affecting checkpoint image handling. Several bug fixes improve core functionality in container operations, volume handling, and API compatibility. Infrastructure improvements ensure better test coverage and platform support.
Changelog entry
- Podman ps: pod sort option is now accepted by --sort flag Pull request #29637
- Podman cp: volume subpath configuration is now honored when copying from containers Pull request #29842
- Events: redundant timestamps removed from journald log output Pull request #29868
- Podman machine: native CA certificate import now handles paths with spaces and special characters Pull request #29853
- Fixed ESRCH error handling in exec session retrieval Pull request #29851
- Podman ps: label lookup in custom format templates now works correctly Pull request #29844
- Compat API: dead and restarting status filters are now ignored gracefully Pull request #29366
- Rootless: pause process environment cleared to prevent buffer overflow Pull request #29657
V5.8.8 and v6.1.3 released with CVE-2026-94603 fix. New features: podman ps pod sorting, cp volume subpath support. Various fixes for label lookup, journald timestamps, and path quoting.
Podman releases v5.8.8 and v6.1.3 address security vulnerability CVE-2026-94603. This week's updates include new sorting capability for pods in podman ps, improved volume subpath handling in podman cp, fixes for table formatting with custom labels, and better cross-platform compatibility. Infrastructure improvements enhance test coverage and path handling robustness.
Week of September 21, 2026
What shipped
- Podman container inspect now exposes IsInitCtr and InitContainerType fields to distinguish init containers from regular containers. Pull request #29818
- PidsLimit 0 is now normalized to unlimited for runc to match Docker behavior across native CLI, compat API, and kube play. Pull request #29827
- The compat API now accepts inline seccomp profiles in HostConfig.SecurityOpt to support Docker clients that send profile JSON directly. Pull request #29726
- Auto-update now supports container filters through CLI, remote bindings, and REST API to selectively update container groups. Pull request #29791
- Rootless quadlet generation now correctly discovers drop-in directories for symlinked rootful quadlets. Pull request #29825
- The cgroup check was moved after help, completion, and subcommand checks to fix podman completion failures in sandboxed environments. Pull request #29832
- The ConsoleSize field in podman inspect now returns the actual TTY size for running containers with terminal enabled. Pull request #28579
- Exec can now be run with no attach streams requested to match Docker's detached exec behavior. Pull request #28686
- The compat API GET /images/{id}/json endpoint now omits the Created field when empty to match Docker API v1.44 behavior. Pull request #29761
- The compat distribution inspect endpoint has been implemented to fix a missing Docker API compatibility feature. Pull request #28358
Why it matters
This week brings several Docker compatibility fixes that improve interoperability with Docker clients and tooling. Init container inspection, seccomp profile handling, and PidsLimit normalization resolve real-world usage issues. Container filtering in auto-update enables more precise deployment workflows.
Changelog entry
- Inspect: expose init container information with IsInitCtr and InitContainerType fields Pull request #29818
- Compat: map pids-limit 0 to unlimited for runc consistency Pull request #29827
- Compat API: accept inline seccomp profiles from Docker clients Pull request #29726
- Auto-update: add container filters via CLI, remote bindings, and REST API Pull request #29791
- Quadlet: resolve symlinks to find drop-ins in target unit directory Pull request #29825
- Move cgroup check below help/completion/subcommands check for sandboxed environments Pull request #29832
- Fix: return actual tty size in
container_inspectConsoleSize field Pull request #28579 - Allow running exec with no attach streams requested for Docker compat Pull request #28686
- Compat: omit empty Created field from GET /images/{id}/json Pull request #29761
- Api: implement compat distribution inspect endpoint Pull request #28358
This week: init container inspection, Docker seccomp profile support, PidsLimit normalization, auto-update filters, quadlet symlink fixes, and more compat API improvements.
Podman shipped container inspection enhancements, improved Docker compatibility for seccomp profiles and exec operations, auto-update filtering for selective container updates, fixes for rootless quadlet symlinks, and standardized PidsLimit behavior. These changes strengthen Docker interoperability and support more sophisticated deployment scenarios.
Week of September 14, 2026
What shipped
- Podman 5.8.7 released with security fixes for CVE-2025-11395 addressing crafted layer tarballs in podman load and symlinks in podman volume import that could overwrite host files. Release
- Podman 6.1.2 released with security fixes for CVE-2025-11395 and related vulnerabilities. Release
- Podman image scp now supports --compression-format and --compression-level options to compress archives during transfer, supporting gzip and zstd formats. Pull request #29395
- New libpod REST API endpoint for autoupdate functionality added, matching the capabilities of the CLI version. Pull request #27025
- Fixed compat container update to preserve existing restart policy unless explicitly overridden in the request. Pull request #29795
- Docker-compat network API now includes the IPRange field in IPAM config, mapping from Libpod's LeaseRange. Pull request #28633
- Podman exec now forwards signals to the exec session's process group, preventing commands from continuing to run after exec is killed. Pull request #29525
- Health check command behavior fixed to use the health check command for startup health checks when --health-startup-cmd is not present, matching Docker behavior. Pull request #27857
- Documentation added explaining rootless bind-mount access through unmapped parent directories and user namespace ID mapping. Pull request #29375
- CPU real-time scheduler options --cpu-rt-period and --cpu-rt-runtime are now hidden and marked as no-ops since Podman 6 dropped cgroups v1 support. Pull request #29784
Why it matters
Two security releases address a critical vulnerability in image and volume import operations that could overwrite host files. Several improvements enhance container compatibility with Docker APIs and add new features for remote image transfer and API functionality.
Changelog entry
- Security: v5.8.7 released addressing CVE-2025-11395 for crafted layer tarballs and symlinks Release
- Security: v6.1.2 released addressing CVE-2025-11395 and related vulnerabilities Release
- Feature: podman image scp adds --compression-format and --compression-level options Pull request #29395
- Feature: New libpod REST API endpoint for autoupdate functionality Pull request #27025
- Fix: Compat container update preserves restart policy unless explicitly changed Pull request #29795
- Fix: Docker-compat network API includes IPRange field in IPAM config Pull request #28633
- Fix: podman exec now forwards signals to the exec session's process group Pull request #29525
- Fix: Health check command used for startup checks when --health-startup-cmd not set Pull request #27857
- Fix: Compat reports cgroup driver 'none' for rootless with cgroupfs Pull request #29303
- Change: --cpu-rt-period and --cpu-rt-runtime hidden and marked as no-ops Pull request #29784
Podman 5.8.7 and 6.1.2 released with security fixes for CVE-2025-11395. New features include compression for image scp, autoupdate REST API endpoint, and improved Docker API compatibility.
This week brings two security releases addressing CVE-2025-11395 affecting image and volume imports. New features include compression options for podman image scp transfers, an autoupdate endpoint in the libpod REST API, improved Docker API compatibility for networks and container updates, fixed signal forwarding in exec sessions, and better health check behavior matching Docker standards.