<?xml version="1.0"?> <interfaceDefinition> <node name="container" owner="${vyos_conf_scripts_dir}/container.py"> <properties> <help>Container applications</help> <priority>450</priority> </properties> <children> <tagNode name="name"> <properties> <help>Container name</help> <constraint> <regex>[-a-zA-Z0-9]+</regex> </constraint> <constraintErrorMessage>Container name must be alphanumeric and can contain hyphens</constraintErrorMessage> </properties> <children> <leafNode name="allow-host-pid"> <properties> <help>Allow sharing host process namespace with container</help> <valueless/> </properties> </leafNode> <leafNode name="allow-host-networks"> <properties> <help>Allow sharing host networking with container</help> <valueless/> </properties> </leafNode> <leafNode name="capability"> <properties> <help>Grant individual Linux capability to container instance</help> <completionHelp> <list>net-admin net-bind-service net-raw setpcap sys-admin sys-module sys-nice sys-time</list> </completionHelp> <valueHelp> <format>net-admin</format> <description>Network operations (interface, firewall, routing tables)</description> </valueHelp> <valueHelp> <format>net-bind-service</format> <description>Bind a socket to privileged ports (port numbers less than 1024)</description> </valueHelp> <valueHelp> <format>net-raw</format> <description>Permission to create raw network sockets</description> </valueHelp> <valueHelp> <format>setpcap</format> <description>Capability sets (from bounded or inherited set)</description> </valueHelp> <valueHelp> <format>sys-admin</format> <description>Administation operations (quotactl, mount, sethostname, setdomainame)</description> </valueHelp> <valueHelp> <format>sys-module</format> <description>Load, unload and delete kernel modules</description> </valueHelp> <valueHelp> <format>sys-nice</format> <description>Permission to set process nice value</description> </valueHelp> <valueHelp> <format>sys-time</format> <description>Permission to set system clock</description> </valueHelp> <constraint> <regex>(net-admin|net-bind-service|net-raw|setpcap|sys-admin|sys-module|sys-nice|sys-time)</regex> </constraint> <multi/> </properties> </leafNode> <node name="sysctl"> <properties> <help>Configure namespaced kernel parameters of the container</help> </properties> <children> <tagNode name="parameter"> <properties> <help>Sysctl key name</help> <completionHelp> <script>${vyos_completion_dir}/list_container_sysctl_parameters.sh</script> </completionHelp> <valueHelp> <format>txt</format> <description>Sysctl key name</description> </valueHelp> <constraint> <validator name="sysctl"/> </constraint> </properties> <children> <leafNode name="value"> <properties> <help>Sysctl configuration value</help> </properties> </leafNode> </children> </tagNode> </children> </node> #include <include/generic-description.xml.i> <tagNode name="device"> <properties> <help>Add a host device to the container</help> </properties> <children> <leafNode name="source"> <properties> <help>Source device (Example: "/dev/x")</help> <valueHelp> <format>txt</format> <description>Source device</description> </valueHelp> </properties> </leafNode> <leafNode name="destination"> <properties> <help>Destination container device (Example: "/dev/x")</help> <valueHelp> <format>txt</format> <description>Destination container device</description> </valueHelp> </properties> </leafNode> </children> </tagNode> #include <include/generic-disable-node.xml.i> <tagNode name="environment"> <properties> <help>Add custom environment variables</help> <constraint> <regex>[-_a-zA-Z0-9]+</regex> </constraint> <constraintErrorMessage>Environment variable name must be alphanumeric and can contain hyphen and underscores</constraintErrorMessage> </properties> <children> <leafNode name="value"> <properties> <help>Set environment option value</help> <valueHelp> <format>txt</format> <description>Set environment option value</description> </valueHelp> </properties> </leafNode> </children> </tagNode> <leafNode name="entrypoint"> <properties> <help>Override the default ENTRYPOINT from the image</help> <constraint> <regex>[ !#-%&(-~]+</regex> </constraint> <constraintErrorMessage>Entrypoint must be ASCII characters, use &quot; and &apos for double and single quotes respectively</constraintErrorMessage> </properties> </leafNode> <leafNode name="host-name"> <properties> <help>Container host name</help> <constraint> #include <include/constraint/host-name.xml.i> </constraint> <constraintErrorMessage>Host-name must be alphanumeric and can contain hyphens</constraintErrorMessage> </properties> </leafNode> <leafNode name="image"> <properties> <help>Container image to use</help> <completionHelp> <script>sudo podman image list --format "{{.Repository}}:{{.Tag}}"</script> </completionHelp> <valueHelp> <format>txt</format> <description>Image name in the hub-registry</description> </valueHelp> <constraint> <regex>[[:ascii:]]{1,255}</regex> </constraint> </properties> </leafNode> <leafNode name="command"> <properties> <help>Override the default CMD from the image</help> <constraint> <regex>[ !#-%&(-~]+</regex> </constraint> <constraintErrorMessage>Command must be ASCII characters, use &quot; and &apos for double and single quotes respectively</constraintErrorMessage> </properties> </leafNode> <leafNode name="arguments"> <properties> <help>The command's arguments for this container</help> <constraint> <regex>[ !#-%&(-~]+</regex> </constraint> <constraintErrorMessage>The command's arguments must be ASCII characters, use &quot; and &apos for double and single quotes respectively</constraintErrorMessage> </properties> </leafNode> <tagNode name="label"> <properties> <help>Add label variables</help> <constraint> <regex>[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?</regex> </constraint> <constraintErrorMessage>Label variable name must be alphanumeric and can contain hyphen, dots and underscores</constraintErrorMessage> </properties> <children> <leafNode name="value"> <properties> <help>Set label option value</help> <valueHelp> <format>txt</format> <description>Set label option value</description> </valueHelp> <constraint> <regex>[[:ascii:]]{1,255}</regex> </constraint> </properties> </leafNode> </children> </tagNode> <leafNode name="cpu-quota"> <properties> <help>This limits the number of CPU resources the container can use</help> <valueHelp> <format>u32:0</format> <description>Unlimited</description> </valueHelp> <valueHelp> <format>txt</format> <description>Amount of CPU time the container can use in amount of cores (up to three decimals)</description> </valueHelp> <constraint> <regex>(0|[1-9]\d*)(\.\d{1,3})?</regex> </constraint> <constraintErrorMessage>Container CPU limit must be a (decimal) number in range 0 to number of threads</constraintErrorMessage> </properties> <defaultValue>0</defaultValue> </leafNode> <leafNode name="memory"> <properties> <help>Memory (RAM) available to this container</help> <valueHelp> <format>u32:0</format> <description>Unlimited</description> </valueHelp> <valueHelp> <format>u32:1-16384</format> <description>Container memory in megabytes (MB)</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-16384"/> </constraint> <constraintErrorMessage>Container memory must be in range 0 to 16384 MB</constraintErrorMessage> </properties> <defaultValue>512</defaultValue> </leafNode> <leafNode name="shared-memory"> <properties> <help>Shared memory available to this container</help> <valueHelp> <format>u32:0</format> <description>Unlimited</description> </valueHelp> <valueHelp> <format>u32:1-8192</format> <description>Container memory in megabytes (MB)</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-8192"/> </constraint> <constraintErrorMessage>Container memory must be in range 0 to 8192 MB</constraintErrorMessage> </properties> <defaultValue>64</defaultValue> </leafNode> <tagNode name="network"> <properties> <help>Attach user defined network to container</help> <completionHelp> <path>container network</path> </completionHelp> #include <include/constraint/container-network.xml.i> </properties> <children> <leafNode name="address"> <properties> <help>Assign static IP address to container</help> <valueHelp> <format>ipv4</format> <description>IPv4 address</description> </valueHelp> <valueHelp> <format>ipv6</format> <description>IPv6 address</description> </valueHelp> <constraint> <validator name="ip-address"/> </constraint> <multi/> </properties> </leafNode> </children> </tagNode> <tagNode name="port"> <properties> <help>Publish port to the container</help> </properties> <children> #include <include/listen-address.xml.i> <leafNode name="source"> <properties> <help>Source host port</help> <valueHelp> <format>u32:1-65535</format> <description>Source host port</description> </valueHelp> <valueHelp> <format>start-end</format> <description>Source host port range (e.g. 10025-10030)</description> </valueHelp> <constraint> <validator name="port-range"/> </constraint> </properties> </leafNode> <leafNode name="destination"> <properties> <help>Destination container port</help> <valueHelp> <format>u32:1-65535</format> <description>Destination container port</description> </valueHelp> <valueHelp> <format>start-end</format> <description>Destination container port range (e.g. 10025-10030)</description> </valueHelp> <constraint> <validator name="port-range"/> </constraint> </properties> </leafNode> <leafNode name="protocol"> <properties> <help>Transport protocol used for port mapping</help> <completionHelp> <list>tcp udp</list> </completionHelp> <valueHelp> <format>tcp</format> <description>Use Transmission Control Protocol for given port</description> </valueHelp> <valueHelp> <format>udp</format> <description>Use User Datagram Protocol for given port</description> </valueHelp> <constraint> <regex>(tcp|udp)</regex> </constraint> </properties> <defaultValue>tcp</defaultValue> </leafNode> </children> </tagNode> <leafNode name="restart"> <properties> <help>Restart options for container</help> <completionHelp> <list>no on-failure always</list> </completionHelp> <valueHelp> <format>no</format> <description>Do not restart containers on exit</description> </valueHelp> <valueHelp> <format>on-failure</format> <description>Restart containers when they exit with a non-zero exit code, retrying indefinitely</description> </valueHelp> <valueHelp> <format>always</format> <description>Restart containers when they exit, regardless of status, retrying indefinitely</description> </valueHelp> <constraint> <regex>(no|on-failure|always)</regex> </constraint> </properties> <defaultValue>on-failure</defaultValue> </leafNode> <leafNode name="uid"> <properties> <help>User ID this container will run as</help> <valueHelp> <format>u32:0-65535</format> <description>User ID this container will run as</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-65535"/> </constraint> </properties> </leafNode> <leafNode name="gid"> <properties> <help>Group ID this container will run as</help> <valueHelp> <format>u32:0-65535</format> <description>Group ID this container will run as</description> </valueHelp> <constraint> <validator name="numeric" argument="--range 0-65535"/> </constraint> </properties> </leafNode> <tagNode name="volume"> <properties> <help>Mount a volume into the container</help> </properties> <children> <leafNode name="source"> <properties> <help>Source host directory</help> <valueHelp> <format>txt</format> <description>Source host directory</description> </valueHelp> </properties> </leafNode> <leafNode name="destination"> <properties> <help>Destination container directory</help> <valueHelp> <format>txt</format> <description>Destination container directory</description> </valueHelp> </properties> </leafNode> <leafNode name="mode"> <properties> <help>Volume access mode ro/rw</help> <completionHelp> <list>ro rw</list> </completionHelp> <valueHelp> <format>ro</format> <description>Volume mounted into the container as read-only</description> </valueHelp> <valueHelp> <format>rw</format> <description>Volume mounted into the container as read-write</description> </valueHelp> <constraint> <regex>(ro|rw)</regex> </constraint> </properties> <defaultValue>rw</defaultValue> </leafNode> <leafNode name="propagation"> <properties> <help>Volume bind propagation</help> <completionHelp> <list>shared slave private rshared rslave rprivate</list> </completionHelp> <valueHelp> <format>shared</format> <description>Sub-mounts of the original mount are exposed to replica mounts</description> </valueHelp> <valueHelp> <format>slave</format> <description>Allow replica mount to see sub-mount from the original mount but not vice versa</description> </valueHelp> <valueHelp> <format>private</format> <description>Sub-mounts within a mount are not visible to replica mounts or the original mount</description> </valueHelp> <valueHelp> <format>rshared</format> <description>Allows sharing of mount points and their nested mount points between both the original and replica mounts</description> </valueHelp> <valueHelp> <format>rslave</format> <description>Allows mount point and their nested mount points between original an replica mounts</description> </valueHelp> <valueHelp> <format>rprivate</format> <description>No mount points within original or replica mounts in any direction</description> </valueHelp> <constraint> <regex>(shared|slave|private|rshared|rslave|rprivate)</regex> </constraint> </properties> <defaultValue>rprivate</defaultValue> </leafNode> </children> </tagNode> </children> </tagNode> <tagNode name="network"> <properties> <help>Network name</help> #include <include/constraint/container-network.xml.i> </properties> <children> #include <include/generic-description.xml.i> <leafNode name="prefix"> <properties> <help>Prefix which allocated to that network</help> <valueHelp> <format>ipv4net</format> <description>IPv4 network prefix</description> </valueHelp> <valueHelp> <format>ipv6net</format> <description>IPv6 network prefix</description> </valueHelp> <constraint> <validator name="ipv4-prefix"/> <validator name="ipv6-prefix"/> </constraint> <multi/> </properties> </leafNode> #include <include/interface/vrf.xml.i> </children> </tagNode> <tagNode name="registry"> <properties> <help>Registry Name</help> </properties> <defaultValue>docker.io quay.io</defaultValue> <children> #include <include/interface/authentication.xml.i> #include <include/generic-disable-node.xml.i> </children> </tagNode> </children> </node> </interfaceDefinition>