# The containers configuration file specifies all of the available configuration
# options and command-line flags for container runtime tools like podman & buildah
# but in a TOML format that can be easily modified and versioned.
#
# Please refer to containers.conf(5) for details of all configuration options.

[containers]

cgroup_conf = [
    "memory.high=1073741824",
]

# List of devices. Specified as
# "<device-on-host>:<device-on-container>:<permissions>", for example: "--device=/dev/sdc:/dev/xvdc:rwm".
#If it is empty or commented out, only the devices
# defined in the container json file by the user/kube will be added.
devices = [
]

# Used to change the name of the default AppArmor profile of container engines. The default
# profile name is "container-default".
apparmor_profile = "container-default"

base_hosts_file = "/etc/hosts2"

container_name_as_hostname = true

# List of default capabilities for containers. If it is empty or commented out,
# only the capabilities defined in the containers json file by the user/kube
# will be added.
default_capabilities = [
    "AUDIT_WRITE",
    "CHOWN",
    "DAC_OVERRIDE",
    "FOWNER",
    "FSETID",
    "KILL",
    "MKNOD",
    "NET_BIND_SERVICE",
    "NET_RAW",
    "SETGID",
    "SETFCAP",
    "SETPCAP",
    "SETUID",
    "SYS_CHROOT",
]

# A list of ulimits to be set in containers by default, specified as
# "<ulimit name>=<soft limit>:<hard limit>", for example:
# "nofile=1024:2048"
# See setrlimit(2) for a list of resource names.
# Any limit not specified here will be inherited from the process launching the container engine
default_ulimits = [
]


# List of default sysctls. If it is empty or commented out, only the sysctls
# defined in the container json file by the user/kube will be added.
default_sysctls = [
]

# Environment variable list for the conmon process, used for passing necessary
# environment variables to conmon or the runtime.
env = [
    "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
]

# Run an init inside the container that forwards signals and reaps processes.
init = false

# Set interface name inside container in legacy way, ethX.
interface_name = ""

host_containers_internal_ip = "1.2.3.4"

# proxy environment variables are passed into the container
http_proxy = false

# whether the container tool will support container labeling.
label = true

# Maximum size allowed for the container log file. Negative numbers indicate
# that no size limit is imposed. If it is positive, it must be >= 8192 to
# match/exceed conmon's read buffer. The file is truncated and re-opened so the
# limit is never exceeded.
log_size_max = -1

log_path = "/var/log/containers"

mounts= [
	"type=glob,source=/tmp/test2*,ro=true",
	"type=bind,source=/etc/services,destination=/etc/services,ro",
]

oom_score_adj = 750

# Maximum number of processes allowed in a container.
pids_limit = 2048

# Path to the seccomp.json profile which is used as the default seccomp profile
# for the runtime.
# seccomp_profile = "/tmp/seccomp.json"

# Size of /dev/shm. Specified as <number><unit>.
# Unit is optional and can be b (bytes), k (kilobytes), m (megabytes), or g (gigabytes). If the unit is omitted, the system uses bytes.
shm_size = "65536k"

#Umask inside the container
umask="0002"

# default network mode
netns="bridge"

# The network table containers settings pertaining to the management of
# CNI plugins.
[network]

# Path to directory where CNI plugin binaries are located.
cni_plugin_dirs = [
  "/usr/libexec/cni",
  "/tmp",
]

# Path to the directory where CNI configuration files are located.
network_config_dir = "/etc/cni/net.d/"

default_subnet_pools = [{"base" = "10.89.0.0/16", "size" = 24}, {"base" = "10.90.0.0/15", "size" = 24}]

default_rootless_network_cmd = "slirp4netns"

# firewall driver to be used by default
firewall_driver = "none"

# dns port for netavark/aardvark
dns_bind_port = 1153

netavark_plugin_dirs = [
  "/usr/netavark"
]

pasta_options = ["-t", "auto"]

[engine]

add_compression = ["zstd", "zstd:chunked"]

# Cgroup management implementation used for the runtime.
cgroup_manager = "systemd"

database_backend = "sqlite"

# Default transport method for pulling and pushing for images
image_default_transport = "docker://"

# Environment variables to pass into conmon
conmon_env_vars = [
		"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
]

image_copy_tmp_dir="storage"

image_volume_mode = "tmpfs"


# Paths to look for the Conmon container manager binary
conmon_path = [
	    "/usr/libexec/podman/conmon",
	    "/usr/local/libexec/podman/conmon",
	    "/usr/local/lib/podman/conmon",
	    "/usr/bin/conmon",
	    "/usr/sbin/conmon",
	    "/usr/local/bin/conmon",
	    "/usr/local/sbin/conmon"
]

# Enforces using docker.io for completing short names in Podman's compatibility
# REST API. Note that this will ignore unqualified-search-registries and
# short-name aliases defined in containers-registries.conf(5).
compat_api_enforce_docker_hub = false

# Specify one or more external providers for the compose command.  The first
# found provider is used for execution. Can be an absolute and relative path or
# a (file) name.
compose_providers=["/some/thing/else", "/than/before"]

# Emit logs on each invocation of the compose command indicating that an
# external compose provider is being executed.
compose_warning_logs = false

# Environment variables to be used when running the container engine (e.g., Podman, Buildah).
# For example "http_proxy=internal.proxy.company.com".
# Note these environment variables will not be used within the container.
# Set the env section under [containers] table, if you want to set environment variables for the container.
env = ["super=duper", "foo=bar"]

# Container init binary
#init_path = "/usr/libexec/podman/catatonit"

# Directory for persistent libpod files (database, etc)
# By default, this will be configured relative to where containers/storage
# stores containers
# Uncomment to change location from this default
#static_dir = "/var/lib/containers/storage/libpod"

# Directory for temporary files. Must be tmpfs (wiped after reboot)
tmp_dir = "/run/libpod"

# Whether to use chroot instead of pivot_root in the runtime
no_pivot_root = false

# Default engine namespace
# If engine is joined to a namespace, it will see only containers and pods
# that were created in the same namespace, and will create new containers and
# pods in that namespace.
# The default namespace is "", which corresponds to no namespace. When no
# namespace is set, all containers and pods are visible.
#namespace = ""

healthcheck_events = false

# A is a list of directories which are used to search for helper binaries.
#
helper_binaries_dir = [
 "/somepath",
]

retry=5
retry_delay="10s"

# Path to OCI hooks directories for automatically executed hooks.
hooks_dir = [
]

# Directories to scan for CDI Spec files.
# cdi_spec_dirs = [ "/etc/cdi", "/var/run/cdi" ]

# Default infra (pause) image name for pod infra containers
infra_image = "registry.k8s.io/pause:3.4.1"

# Default command to run the infra container
infra_command = "/pause"

# Default k8s kind/type to generate with `podman kube generate`
kube_generate_type = "pod"

# Number of seconds to wait without a connection
# before the `podman system service` times out and exits
#
service_timeout=300

# Determines whether engine will reserve ports on the host when they are
# forwarded to containers. When enabled, when ports are forwarded to containers,
# they are held open by conmon as long as the container is running, ensuring that
# they cannot be reused by other programs on the host. However, this can cause
# significant memory usage if a container has many ports forwarded to it.
# Disabling this can save memory.
#enable_port_reservation = true

# Default engine support for container labeling
# label=true

# Number of locks available for containers and pods.
# If this is changed, a lock renumber must be performed (e.g. with the
# 'podman system renumber' command).
num_locks = 2048

# Directory for engine named volumes.
# By default, this will be configured relative to where containers/storage
# stores containers.
# Uncomment to change location from this default.
#volume_path = "/var/lib/containers/storage/volumes"

# Selects which logging mechanism to use for Podman events.  Valid values
# are `journald` or `file`.
# events_logger = "journald"

# Specify the keys sequence used to detach a container.
# Format is a single character [a-Z] or a comma separated sequence of
# `ctrl-<value>`, where `<value>` is one of:
# `a-z`, `@`, `^`, `[`, `\`, `]`, `^` or `_`
#
# detach_keys = "ctrl-p,ctrl-q"

# Default OCI runtime
runtime = "runc"

# List of the OCI runtimes that support --format=json.  When json is supported
# engine will use it for reporting nicer errors.
runtime_supports_json = ["runc"]

# SSH config file path
ssh_config = "/foo/bar/.ssh/config"

# Deprecated in favor of podmansh.Timeout, should not be used anymore.
podmansh_timeout = 300

# Paths to look for a valid OCI runtime (runc, runv, etc)
[engine.runtimes]
runc = [
	   	"/usr/bin/runc",
		"/usr/sbin/runc",
		"/usr/local/bin/runc",
		"/usr/local/sbin/runc",
		"/sbin/runc",
		"/bin/runc",
		"/usr/lib/cri-o-runc/sbin/runc",
]

crun = [
	    "/usr/bin/crun",
	    "/usr/local/bin/crun",
]

# Default flags for a valid OCI runtime (crun, runc, kata, runsc, krun, etc)
# Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json, the option given is log-format=json.
[engine.runtimes_flags]
crun = [
    "debug"
]

runsc = [
    "net-raw"
]

[podmansh]
# Shell to start in container. Default: /bin/sh.
shell = "/bin/zsh"
# Name of the container the podmansh user should join.
container = "podmansh-1"
# Number of seconds to wait for podmansh logins.
timeout = 42

[machine]
# Number of CPU's a machine is created with.
cpus=1

# The size of the disk in GB created when init-ing a podman-machine VM
disk_size = 20

# The image used when creating a podman-machine VM.
image = "https://example.com/$OS/$ARCH/foobar.ami"

# Memory in MB a machine is created with.

memory=1024

# Rosetta supports running x86_64 Linux binaries on a Podman machine on Apple silicon.
# The default value is `true`. Supported on AppleHV(arm64) machines only.
rosetta=false

# The [machine] table MUST be the last thing in this file.
# (Unless another table is added)
# TOML does not provide a way to end a table other than a further table being
# defined, so every key hereafter will be part of [machine] and not the main
# config.