starred/container
1
0
Fork 0
mirror of https://github.com/apple/container.git synced 2026-09-28 01:46:25 -04:00
Code Issues Packages Projects Releases Wiki Activity

Add --read-only-path and --masked-path option to container run / create (#2069)

Browse Source
This commit is contained in:
Aditya Ramani
2026-08-04 19:04:50 -07:00
committed by GitHub
parent cee0ba80cd
commit ddaf2ca5ac
7 changed files with 438 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/command-reference.md
+4
View File
@@ -57,6 +57,7 @@ container run [<options>] <image> [<arguments> ...]
* `--init-image <image>`: Use a custom init image instead of the default. This allows customizing boot-time behavior before the OCI container starts, such as running VM-level daemons, configuring eBPF filters, or debugging the init process.
* `-k, --kernel <path>`: Set a custom kernel path
* `-l, --label <label>`: Add a key=value label to the container
* `--masked-path <path>`: **Experimental.** Hide a path inside the container, in addition to the runtime defaults (or `NONE` to clear prior values and the defaults)
* `--mount <mount>`: Add a mount to the container (format: type=<>,source=<>,target=<>,readonly)
* `--name <name>`: Use the specified name as the container ID
* `--network <network>`: Attach the container to a network (format: `<name>[,mac=XX:XX:XX:XX:XX:XX][,mtu=VALUE]`)
@@ -66,6 +67,7 @@ container run [<options>] <image> [<arguments> ...]
* `--platform <platform>`: Platform for the image if it's multi-platform. This takes precedence over --os and --arch
* `--publish-socket <spec>`: Publish a socket from container to host (format: host_path:container_path)
* `--read-only`: Mount the container's root filesystem as read-only
* `--read-only-path <path>`: **Experimental.** Mark a path inside the container read-only, in addition to the runtime defaults (or `NONE` to clear prior values and the defaults)
* `--rm, --remove`: Remove the container after it stops
* `--rosetta`: Enable Rosetta in the container
* `--runtime`: Set the runtime handler for the container (default: container-runtime-linux)
@@ -231,6 +233,7 @@ container create [<options>] <image> [<arguments> ...]
* `--init-image <image>`: Use a custom init image instead of the default. This allows customizing boot-time behavior before the OCI container starts, such as running VM-level daemons, configuring eBPF filters, or debugging the init process.
* `-k, --kernel <path>`: Set a custom kernel path
* `-l, --label <label>`: Add a key=value label to the container
* `--masked-path <path>`: **Experimental.** Hide a path inside the container, in addition to the runtime defaults (or `NONE` to clear prior values and the defaults)
* `--mount <mount>`: Add a mount to the container (format: type=<>,source=<>,target=<>,readonly)
* `--name <name>`: Use the specified name as the container ID
* `--network <network>`: Attach the container to a network (format: `<name>[,mac=XX:XX:XX:XX:XX:XX][,mtu=VALUE]`)
@@ -240,6 +243,7 @@ container create [<options>] <image> [<arguments> ...]
* `--platform <platform>`: Platform for the image if it's multi-platform. This takes precedence over --os and --arch
* `--publish-socket <spec>`: Publish a socket from container to host (format: host_path:container_path)
* `--read-only`: Mount the container's root filesystem as read-only
* `--read-only-path <path>`: **Experimental.** Mark a path inside the container read-only, in addition to the runtime defaults (or `NONE` to clear prior values and the defaults)
* `--rm, --remove`: Remove the container after it stops
* `--rosetta`: Enable Rosetta in the container
* `--runtime`: Set the runtime handler for the container (default: container-runtime-linux)