From 5d6fa52b8985f8068314aba26878a1d7d5cb84e5 Mon Sep 17 00:00:00 2001
From: Yuriy Andamasov <yuriy@vyos.io>
Date: Wed, 6 May 2026 20:42:32 +0300
Subject: feat: flip swap mechanism — MD as primary, RST as override (Phase 1)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the first of three phases inverting the per-page swap mechanism
so MD becomes the canonical primary and RST becomes the rare override.

Phase 1 — file renames + conf.py exclude_patterns flip only:
- Rename docs/**/md-<stem>.md to docs/**/<stem>.md (drop md- prefix)
  for all 254 stems previously listed in docs/_swap.txt
- Rename docs/**/<stem>.rst to docs/**/rst-<stem>.rst (add rst- prefix)
  for the same 254 stems
- Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty
  comment-only since no pages need the RST fallback right now
- conf.py exclude_patterns flipped: rst-*.rst is now excluded by default
  instead of md-*.md
- conf.py runtime-artifact references updated to _rst_override_state.json
  and _md_exclude.txt (Phase 2 will rewrite swap_sources.py to produce
  these names; for now no swap script runs because overrides list is empty)

Phase 2 (next commit on this branch) will rewrite scripts/swap_sources.py
with inverted rename direction, delete scripts/import_myst.py + tests, and
update tests/test_swap_sources.py for the new semantics.

Phase 3 will be the cleanup pass and ready-for-review flip.

Generated by robots https://vyos.io
---
 docs/configuration/container/index.md      | 479 +++++++++++++++++++++++++++++
 docs/configuration/container/index.rst     | 417 -------------------------
 docs/configuration/container/md-index.md   | 479 -----------------------------
 docs/configuration/container/rst-index.rst | 417 +++++++++++++++++++++++++
 4 files changed, 896 insertions(+), 896 deletions(-)
 create mode 100644 docs/configuration/container/index.md
 delete mode 100644 docs/configuration/container/index.rst
 delete mode 100644 docs/configuration/container/md-index.md
 create mode 100644 docs/configuration/container/rst-index.rst

(limited to 'docs/configuration/container')

diff --git a/docs/configuration/container/index.md b/docs/configuration/container/index.md
new file mode 100644
index 00000000..db46db38
--- /dev/null
+++ b/docs/configuration/container/index.md
@@ -0,0 +1,479 @@
+---
+lastproofread: '2024-07-03'
+---
+
+# Container
+
+The VyOS container implementation is based on [Podman](https://podman.io/) as
+a daemonless container engine.
+
+## Configuration
+
+```{cfgcmd} set container name \<name\> image
+
+Sets the image name in the hub registry
+
+:::{code-block} none
+set container name mysql-server image mysql:8.0
+:::
+
+If a registry is not specified, Docker.io will be used as the container
+registry unless an alternative registry is specified using
+`set container registry <name>` or the registry is included
+in the image name
+
+:::{code-block} none
+set container name mysql-server image quay.io/mysql:8.0
+:::
+```
+
+
+```{cfgcmd} set container name \<name\> entrypoint \<entrypoint\>
+
+Override the default entrypoint from the image for a container.
+```
+
+
+```{cfgcmd} set container name \<name\> command \<command\>
+
+Override the default command from the image for a container.
+```
+
+
+```{cfgcmd} set container name \<name\> arguments \<arguments\>
+
+Set the command arguments for a container.
+```
+
+
+```{cfgcmd} set container name \<name\> host-name \<hostname\>
+
+Set the host name for a container.
+```
+
+
+```{cfgcmd} set container name \<name\> allow-host-pid
+
+The container and the host share the same process namespace.
+This means that processes running on the host are visible inside the
+container, and processes inside the container are visible on the host.
+
+The command translates to "--pid host" when the container is created.
+```
+
+
+```{cfgcmd} set container name \<name\> allow-host-networks
+
+Allow host networking in a container. The network stack of the container is
+not isolated from the host and will use the host IP.
+
+The command translates to "--net host" when the container is created.
+
+:::{note}
+**allow-host-networks** cannot be used with **network**
+:::
+```
+
+
+```{cfgcmd} set container name \<name\> network \<networkname\>
+
+Attaches user-defined network to a container.
+Only one network must be specified and must already exist.
+```
+
+
+```{cfgcmd} set container name \<name\> network \<networkname\> address \<address\>
+
+Optionally set a specific static IPv4 or IPv6 address for the container.
+This address must be within the named network prefix.
+
+:::{note}
+The first IP in the container network is reserved by the
+engine and cannot be used
+:::
+```
+
+
+```{cfgcmd} set container name \<name\> name-server \<address\>
+
+Optionally set a custom name server.
+If a container network is used with DNS enabled,
+this setting will not have any effect.
+```
+
+
+```{cfgcmd} set container name \<name\> description \<text\>
+
+Set a container description
+```
+
+
+```{cfgcmd} set container name \<name\> environment \<key\> value \<value\>
+
+Add custom environment variables.
+Multiple environment variables are allowed.
+The following commands translate to "-e key=value" when the container
+is created.
+
+:::{code-block} none
+set container name mysql-server environment MYSQL_DATABASE value 'zabbix'
+set container name mysql-server environment MYSQL_USER value 'zabbix'
+set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd'
+set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd'
+:::
+```
+
+
+```{cfgcmd} set container name \<name\> port \<portname\> source \<portnumber\>
+
+```
+```{cfgcmd} set container name \<name\> port \<portname\> destination \<portnumber\>
+```
+
+```{cfgcmd} set container name \<name\> port \<portname\> protocol \<tcp | udp\>
+
+Publish a port for the container.
+
+:::{code-block} none
+set container name zabbix-web-nginx-mysql port http source 80
+set container name zabbix-web-nginx-mysql port http destination 8080
+set container name zabbix-web-nginx-mysql port http protocol tcp
+:::
+```
+:::{note}
+Port publishing cannot be used with **network**. For this purpose, a workaround
+using destination NAT and static IP assignment for the container is available.
+:::
+```{cfgcmd} set container name \<name\> volume \<volumename\> source \<path\>
+```
+
+```{cfgcmd} set container name \<name\> volume \<volumename\> destination \<path\>
+
+Mount a volume into the container
+
+:::{code-block} none
+set container name coredns volume 'corefile' source /config/coredns/Corefile
+set container name coredns volume 'corefile' destination /etc/Corefile
+:::
+```
+
+```{cfgcmd} set container name \<name\> volume \<volumename\> mode \<ro | rw\>
+
+Volume is either mounted as rw (read-write - default) or ro (read-only)
+```
+
+```{cfgcmd} set container name \<name\> tmpfs \<tmpfsname\> destination \<path\>
+
+Mount a tmpfs *(ramdisk)* filesystem to the given path within the container.
+```
+
+```{cfgcmd} set container name \<name\> tmpfs \<tmpfsname\> size \<MB\>
+
+Size in MB for tmpfs filesystem, maximum size is 64GB or 50% of the
+systems total available memory.
+```
+
+```{cfgcmd} set container name \<name\> uid \<number\>
+```
+
+```{cfgcmd} set container name \<name\> gid \<number\>
+
+Set the User ID or Group ID of the container
+```
+
+```{cfgcmd} set container name \<name\> restart [no | on-failure | always]
+
+Set the restart behavior of the container.
+
+- **no**: Do not restart containers on exit
+- **on-failure**: Restart containers when they exit with a non-zero
+exit code, retrying indefinitely (default)
+- **always**: Restart containers when they exit, regardless of status,
+retrying indefinitely
+```
+
+```{cfgcmd} set container name \<name\> cpu-quota \<num\>
+
+This specifies the number of CPU resources the container can use.
+
+Default is 0 for unlimited.
+For example, 1.25 limits the container to use up to 1.25 cores
+worth of CPU time.
+This can be a decimal number with up to three decimal places.
+
+The command translates to "--cpus=\<num\>" when the container is created.
+```
+
+```{cfgcmd} set container name \<name\> memory \<MB\>
+
+Constrain the memory available to the container.
+
+Default is 512 MB. Use 0 MB for unlimited memory.
+```
+
+```{cfgcmd} set container name \<name\> device \<devicename\> source \<path\>
+```
+
+```{cfgcmd} set container name \<name\> device \<devicename\> destination \<path\>
+
+Add a host device to the container.
+```
+
+```{cfgcmd} set container name \<name\> capability \<text\>
+
+Set container capabilities or permissions.
+
+- **net-admin**: Network operations (interface, firewall, routing tables)
+- **net-bind-service**: Bind a socket to privileged ports
+(port numbers less than 1024)
+- **net-raw**: Permission to create raw network sockets
+- **setpcap**: Capability sets (from bounded or inherited set)
+- **sys-admin**: Administration operations (quotactl, mount, sethostname,
+setdomainame)
+- **sys-time**: Permission to set system clock
+```
+
+```{cfgcmd} set container name \<name\> sysctl parameter \<parameter\> value \<value\>
+
+Set container sysctl values.
+
+The subset of possible parameters are:
+
+- Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem,
+kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced
+- Parameters beginning with fs.mqueue.*
+- Parameters beginning with net.* (only if user-defined network is used)
+```
+
+```{cfgcmd} set container name \<name\> label \<label\> value \<value\>
+
+Add metadata label for this container.
+```
+
+```{cfgcmd} set container name \<name\> disable
+
+Disable a container.
+```
+
+### Container Health checks
+
+
+By default, no health checks are run, even when defined by the image.
+
+```{cfgcmd} set container name \<name\> health-check
+
+Default health check is run for the container if defined by the image.
+```
+
+```{cfgcmd} set container name \<name\> health-check command \<command\>
+
+Override the default health check command from the image for a container.
+```
+
+```{cfgcmd} set container name \<name\> health-check interval \<interval\>
+
+Override the default health-check interval. For example: `60`
+```
+
+```{cfgcmd} set container name \<name\> health-check timeout \<timeout\>
+
+Override the default health-check timeout. For example: `10`
+```
+
+```{cfgcmd} set container name \<name\> health-check retries \<retries\>
+
+Number of health check retries before container is considered unhealthy. For example: `1`
+```
+
+### Container Networks
+
+```{cfgcmd} set container network \<name\>
+
+Creates a named container network
+```
+
+```{cfgcmd} set container network \<name\> description
+
+A brief description what this network is all about.
+```
+
+```{cfgcmd} set container network \<name\> prefix \<ipv4|ipv6\>
+
+Define IPv4 and/or IPv6 prefix for a given network name.
+Both IPv4 and IPv6 can be used in parallel.
+```
+
+```{cfgcmd} set container network \<name\> mtu \<number\>
+
+Configure {abbr}`MTU (Maximum Transmission Unit)` for a given network. It
+is the size (in bytes) of the largest ethernet frame sent on this link.
+```
+
+```{cfgcmd} set container network \<name\> no-name-server
+
+Disable Domain Name System (DNS) plugin for this network.
+```
+
+```{cfgcmd} set container network \<name\> vrf \<name\>
+
+Bind container network to a given VRF instance.
+```
+
+### Container Registry
+
+```{cfgcmd} set container registry \<name\>
+
+Adds registry to list of unqualified-search-registries. By default, for any
+image that does not include the registry in the image name, VyOS will use
+docker.io and quay.io as the container registry.
+```
+
+```{cfgcmd} set container registry \<name\> disable
+
+Disable a given container registry
+```
+
+```{cfgcmd} set container registry \<name\> authentication username
+```
+
+```{cfgcmd} set container registry \<name\> authentication password
+
+Some container registries require credentials to be used.
+
+Credentials can be defined here and will only be used when adding a
+container image to the system.
+```
+
+```{cfgcmd} set container registry \<name\> insecure
+
+Allow registry access over unencrypted HTTP or TLS connections with
+untrusted certificates.
+```
+
+```{cfgcmd} set container registry \<name\> mirror address \<address\>
+```
+
+```{cfgcmd} set container registry \<name\> mirror host-name \<host-name\>
+```
+
+```{cfgcmd} set container registry \<name\> mirror port \<port\>
+```
+
+```{cfgcmd} set container registry \<name\> mirror path \<path\>
+
+Registry mirror, use ``(host-name|address)[:port][/path]``.
+
+If you have mirror http://192.168.1.1:8080 for docker.io, you can use ``docker.io/some/repo`` or run ``podman pull docker.io/some/repo``
+
+:::{code-block} none
+set container registry docker.io mirror address 192.168.1.1
+set container registry docker.io mirror port 8080
+set container registry docker.io insecure
+:::
+If http://192.168.1.1:8080 is your own registry, you can use ``192.168.1.1:8080/some/repo`` or run ``podman pull 192.168.1.1:8080/some/repo``
+
+:::{code-block} none
+set container registry 192.168.1.1:8080 insecure
+:::
+```
+
+### Log Configuration
+
+```{cfgcmd} set container name \<name\> log-driver [k8s-file | journald | none]
+
+Set the default log driver for containers.
+
+- **k8s-file**: Log to a plain text file in Kubernetes-style format.
+- **journald**: Log to the system journal
+- **none**: Disable logging for the container
+
+Current default is journald.
+
+```
+
+## Operation Commands
+
+```{opcmd} add container image \<containername\>
+
+Pull a new image for container
+```
+```{opcmd} show container
+
+Show the list of all active containers.
+```
+```{opcmd} show container image
+
+Show the local container images.
+```
+```{opcmd} show container log \<containername\>
+
+Show logs from a given container
+```
+```{opcmd} show container network
+
+Show a list available container networks
+```
+```{opcmd} restart container \<containername\>
+
+Restart a given container
+```
+```{opcmd} update container image \<containername\>
+
+Update container image
+```
+```{opcmd} delete container image \<image id|all\> [force]
+
+Delete a particular container image based on it's image ID.
+You can also delete all container images at once.
+
+You can not delete a container image if it has more then one tag
+assigned, this is why there is a `force` option to pass down to
+the container image to also remove those images.
+```
+
+## Example Configuration
+
+For the sake of demonstration, [example #1 in the official documentation](https://www.zabbix.com/documentation/current/manual/installation/containers)
+to the declarative VyOS CLI syntax.
+
+```none
+set container network zabbix prefix 172.20.0.0/16
+set container network zabbix description 'Network for Zabbix component containers'
+
+set container name mysql-server image mysql:8.0
+set container name mysql-server network zabbix
+
+set container name mysql-server environment 'MYSQL_DATABASE' value 'zabbix'
+set container name mysql-server environment 'MYSQL_USER' value 'zabbix'
+set container name mysql-server environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
+set container name mysql-server environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
+
+set container name zabbix-java-gateway image zabbix/zabbix-java-gateway:alpine-5.2-latest
+set container name zabbix-java-gateway network zabbix
+
+set container name zabbix-server-mysql image zabbix/zabbix-server-mysql:alpine-5.2-latest
+set container name zabbix-server-mysql network zabbix
+
+set container name zabbix-server-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
+set container name zabbix-server-mysql environment 'MYSQL_DATABASE' value 'zabbix'
+set container name zabbix-server-mysql environment 'MYSQL_USER' value 'zabbix'
+set container name zabbix-server-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
+set container name zabbix-server-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
+set container name zabbix-server-mysql environment 'ZBX_JAVAGATEWAY' value 'zabbix-java-gateway'
+
+set container name zabbix-server-mysql port zabbix source 10051
+set container name zabbix-server-mysql port zabbix destination 10051
+
+set container name zabbix-web-nginx-mysql image zabbix/zabbix-web-nginx-mysql:alpine-5.2-latest
+set container name zabbix-web-nginx-mysql network zabbix
+
+set container name zabbix-web-nginx-mysql environment 'MYSQL_DATABASE' value 'zabbix'
+set container name zabbix-web-nginx-mysql environment 'ZBX_SERVER_HOST' value 'zabbix-server-mysql'
+set container name zabbix-web-nginx-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
+set container name zabbix-web-nginx-mysql environment 'MYSQL_USER' value 'zabbix'
+set container name zabbix-web-nginx-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
+set container name zabbix-web-nginx-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
+
+set container name zabbix-web-nginx-mysql port http source 80
+set container name zabbix-web-nginx-mysql port http destination 8080
+```
diff --git a/docs/configuration/container/index.rst b/docs/configuration/container/index.rst
deleted file mode 100644
index 398f1941..00000000
--- a/docs/configuration/container/index.rst
+++ /dev/null
@@ -1,417 +0,0 @@
-:lastproofread: 2024-07-03
-
-#########
-Container
-#########
-
-The VyOS container implementation is based on `Podman <https://podman.io/>`_ as
-a deamonless container engine.
-
-*************
-Configuration
-*************
-
-.. cfgcmd:: set container name <name> image
-
-    Sets the image name in the hub registry
-
-    .. code-block:: none
-
-      set container name mysql-server image mysql:8.0
-
-    If a registry is not specified, Docker.io will be used as the container
-    registry unless an alternative registry is specified using
-    **set container registry <name>** or the registry is included
-    in the image name
-
-    .. code-block:: none
-
-      set container name mysql-server image quay.io/mysql:8.0
-
-.. cfgcmd:: set container name <name> entrypoint <entrypoint>
-
-   Override the default entrypoint from the image for a container.
-
-.. cfgcmd:: set container name <name> command <command>
-
-    Override the default command from the image for a container.
-
-.. cfgcmd:: set container name <name> arguments <arguments>
-
-    Set the command arguments for a container.
-
-.. cfgcmd:: set container name <name> host-name <hostname>
-
-    Set the host name for a container.
-
-.. cfgcmd:: set container name <name> allow-host-pid
-
-    The container and the host share the same process namespace.
-    This means that processes running on the host are visible inside the
-    container, and processes inside the container are visible on the host.
-
-    The command translates to "--pid host" when the container is created.
-
-.. cfgcmd:: set container name <name> allow-host-networks
-
-    Allow host networking in a container. The network stack of the container is
-    not isolated from the host and will use the host IP.
-
-    The command translates to "--net host" when the container is created.
-
-    .. note:: **allow-host-networks** cannot be used with **network**
-
-.. cfgcmd:: set container name <name> network <networkname>
-
-    Attaches user-defined network to a container.
-    Only one network must be specified and must already exist.
-
-.. cfgcmd:: set container name <name> network <networkname> address <address>
-
-    Optionally set a specific static IPv4 or IPv6 address for the container.
-    This address must be within the named network prefix.
-
-    .. note:: The first IP in the container network is reserved by the
-       engine and cannot be used
-
-.. cfgcmd:: set container name <name> name-server <address>
-
-    Optionally set a custom name server.
-    If a container network is used with DNS enabled,
-    this setting will not have any effect.
-
-.. cfgcmd:: set container name <name> description <text>
-
-    Set a container description
-
-.. cfgcmd:: set container name <name> environment <key> value <value>
-
-    Add custom environment variables.
-    Multiple environment variables are allowed.
-    The following commands translate to "-e key=value" when the container
-    is created.
-
-    .. code-block:: none
-
-        set container name mysql-server environment MYSQL_DATABASE value 'zabbix'
-        set container name mysql-server environment MYSQL_USER value 'zabbix'
-        set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd'
-        set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd'
-
-.. cfgcmd:: set container name <name> port <portname> source <portnumber>
-.. cfgcmd:: set container name <name> port <portname> destination <portnumber>
-.. cfgcmd:: set container name <name> port <portname> protocol <tcp | udp>
-
-    Publish a port for the container.
-
-    .. code-block:: none
-
-        set container name zabbix-web-nginx-mysql port http source 80
-        set container name zabbix-web-nginx-mysql port http destination 8080
-        set container name zabbix-web-nginx-mysql port http protocol tcp
-
-.. note:: Port publishing cannot be used with **network**. For this purpose, a workaround
-          using destination NAT and static IP assignment for the container is available.
-
-.. cfgcmd:: set container name <name> volume <volumename> source <path>
-.. cfgcmd:: set container name <name> volume <volumename> destination <path>
-
-    Mount a volume into the container
-
-    .. code-block:: none
-
-        set container name coredns volume 'corefile' source /config/coredns/Corefile
-        set container name coredns volume 'corefile' destination /etc/Corefile
-
-.. cfgcmd:: set container name <name> volume <volumename> mode <ro | rw>
-
-    Volume is either mounted as rw (read-write - default) or ro (read-only)
-
-.. cfgcmd:: set container name <name> tmpfs <tmpfsname> destination <path>
-
-    Mount a tmpfs *(ramdisk)* filesystem to the given path within the container.
-
-.. cfgcmd:: set container name <name> tmpfs <tmpfsname> size <MB>
-
-    Size in MB for tmpfs filesystem, maximum size is 64GB or 50% of the
-    systems total available memory.
-
-.. cfgcmd:: set container name <name> uid <number>
-.. cfgcmd:: set container name <name> gid <number>
-
-    Set the User ID or Group ID of the container
-
-.. cfgcmd:: set container name <name> restart [no | on-failure | always]
-
-   Set the restart behavior of the container.
-
-   - **no**: Do not restart containers on exit
-   - **on-failure**: Restart containers when they exit with a non-zero
-     exit code, retrying indefinitely (default)
-   - **always**: Restart containers when they exit, regardless of status,
-     retrying indefinitely
-
-.. cfgcmd:: set container name <name> cpu-quota <num>
-
-   This specifies the number of CPU resources the container can use.
-
-   Default is 0 for unlimited.
-   For example, 1.25 limits the container to use up to 1.25 cores
-   worth of CPU time.
-   This can be a decimal number with up to three decimal places.
-
-   The command translates to "--cpus=<num>" when the container is created.
-
-.. cfgcmd:: set container name <name> memory <MB>
-
-   Constrain the memory available to the container.
-
-   Default is 512 MB. Use 0 MB for unlimited memory.
-
-.. cfgcmd:: set container name <name> device <devicename> source <path>
-.. cfgcmd:: set container name <name> device <devicename> destination <path>
-
-   Add a host device to the container.
-
-.. cfgcmd:: set container name <name> capability <text>
-
-   Set container capabilities or permissions.
-
-   - **net-admin**: Network operations (interface, firewall, routing tables)
-   - **net-bind-service**: Bind a socket to privileged ports
-     (port numbers less than 1024)
-   - **net-raw**: Permission to create raw network sockets
-   - **setpcap**: Capability sets (from bounded or inherited set)
-   - **sys-admin**: Administration operations (quotactl, mount, sethostname,
-     setdomainame)
-   - **sys-time**: Permission to set system clock
-
-.. cfgcmd:: set container name <name> sysctl parameter <parameter> value <value>
-
-   Set container sysctl values.
-
-   The subset of possible parameters are:
-
-   - Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem,
-     kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced
-   - Parameters beginning with fs.mqueue.*
-   - Parameters beginning with net.* (only if user-defined network is used)
-
-.. cfgcmd:: set container name <name> label <label> value <value>
-
-   Add metadata label for this container.
-
-.. cfgcmd:: set container name <name> disable
-
-   Disable a container.
-
-Container Health checks
-=======================
-
-By default, no health checks are run, even when defined by the image.
-
-.. cfgcmd:: set container name <name> health-check
-
-    Default health check is run for the container if defined by the image.
-
-.. cfgcmd:: set container name <name> health-check command <command>
-
-    Override the default health check command from the image for a container.
-
-.. cfgcmd:: set container name <name> health check interval <interval>
-
-    Override the default health-check interval. For example: `60`
-
-.. cfgcmd:: set container name <name> health check timeout <timeout>
-
-    Override the default health-check timeout. For example: `10`
-
-.. cfgcmd:: set container name <name> health check retries <retries>
-
-    Number of health check retries before container is considered unhealthy. For example: `1`
-
-Container Networks
-==================
-
-.. cfgcmd:: set container network <name>
-
-    Creates a named container network
-
-.. cfgcmd:: set container network <name> description
-
-    A brief description what this network is all about.
-
-.. cfgcmd:: set container network <name> prefix <ipv4|ipv6>
-
-    Define IPv4 and/or IPv6 prefix for a given network name.
-    Both IPv4 and IPv6 can be used in parallel.
-
-.. cfgcmd:: set container network <name> mtu <number>
-
-    Configure :abbr:`MTU (Maximum Transmission Unit)` for a given network. It
-    is the size (in bytes) of the largest ethernet frame sent on this link.
-
-.. cfgcmd:: set container network <name> no-name-server
-
-    Disable Domain Name System (DNS) plugin for this network.
-
-.. cfgcmd:: set container network <name> vrf <nme>
-
-    Bind container network to a given VRF instance.
-
-Container Registry
-==================
-
-.. cfgcmd:: set container registry <name>
-
-    Adds registry to list of unqualified-search-registries. By default, for any
-    image that does not include the registry in the image name, VyOS will use
-    docker.io and quay.io as the container registry.
-
-.. cfgcmd:: set container registry <name> disable
-
-    Disable a given container registry
-
-.. cfgcmd:: set container registry <name> authentication username
-.. cfgcmd:: set container registry <name> authentication password
-
-    Some container registries require credentials to be used.
-
-    Credentials can be defined here and will only be used when adding a
-    container image to the system.
-
-.. cfgcmd:: set container registry <name> insecure
-
-    Allow registry access over unencrypted HTTP or TLS connections with
-    untrusted certificates.
-
-.. cfgcmd:: set container registry <name> mirror address <address>
-
-.. cfgcmd:: set container registry <name> mirror host-name <host-name>
-
-.. cfgcmd:: set container registry <name> mirror port <port>
-
-.. cfgcmd:: set container registry <name> mirror path <path>
-
-    Registry mirror, use ``(host-name|address)[:port][/path]``.
-
-    If you have mirror http://192.168.1.1:8080 for docker.io, you can use ``docker.io/some/repo`` or run ``podman pull docker.io/some/repo``
-
-    .. code-block:: none
-
-        set container registry docker.io mirror address 192.168.1.1
-        set container registry docker.io mirror port 8080
-        set container registry docker.io insecure
-
-    If http://192.168.1.1:8080 is your own registry, you can use ``192.168.1.1:8080/some/repo`` or run ``podman pull 192.168.1.1:8080/some/repo``
-
-    .. code-block:: none
-
-        set container registry 192.168.1.1:8080 insecure
-
-
-Log Configuration
-====================
-
-.. cfgcmd:: set container name <name> log-driver [k8s-file | journald | none]
-
-   Set the default log driver for containers.
-
-   - **k8s-file**: Log to a plain text file in Kubernetes-style format.
-   - **journald**: Log to the system journal
-   - **none**: Disable logging for the container
-
-   Current default is journald. 
-
-
-******************
-Operation Commands
-******************
-
-.. opcmd:: add container image <containername>
-
-    Pull a new image for container
-
-.. opcmd:: show container
-
-    Show the list of all active containers.
-
-.. opcmd:: show container image
-
-    Show the local container images.
-
-.. opcmd:: show container log <containername>
-
-    Show logs from a given container
-
-.. opcmd:: show container network
-
-    Show a list available container networks
-
-.. opcmd:: restart container <containername>
-
-    Restart a given container
-
-.. opcmd:: update container image <containername>
-
-    Update container image
-
-.. opcmd:: delete container image <image id|all> [force]
-
-    Delete a particular container image based on it's image ID.
-    You can also delete all container images at once.
-
-    You can not delete a container image if it has more then one tag
-    assigned, this is why there is a `force` option to pass down to
-    the container image to also remove those images.
-
-*********************
-Example Configuration
-*********************
-
-    For the sake of demonstration, `example #1 in the official documentation
-    <https://www.zabbix.com/documentation/current/manual/
-    installation/containers>`_
-    to the declarative VyOS CLI syntax.
-
-    .. code-block:: none
-
-        set container network zabbix prefix 172.20.0.0/16
-        set container network zabbix description 'Network for Zabbix component containers'
-
-        set container name mysql-server image mysql:8.0
-        set container name mysql-server network zabbix
-
-        set container name mysql-server environment 'MYSQL_DATABASE' value 'zabbix'
-        set container name mysql-server environment 'MYSQL_USER' value 'zabbix'
-        set container name mysql-server environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
-        set container name mysql-server environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
-
-        set container name zabbix-java-gateway image zabbix/zabbix-java-gateway:alpine-5.2-latest
-        set container name zabbix-java-gateway network zabbix
-
-        set container name zabbix-server-mysql image zabbix/zabbix-server-mysql:alpine-5.2-latest
-        set container name zabbix-server-mysql network zabbix
-
-        set container name zabbix-server-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
-        set container name zabbix-server-mysql environment 'MYSQL_DATABASE' value 'zabbix'
-        set container name zabbix-server-mysql environment 'MYSQL_USER' value 'zabbix'
-        set container name zabbix-server-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
-        set container name zabbix-server-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
-        set container name zabbix-server-mysql environment 'ZBX_JAVAGATEWAY' value 'zabbix-java-gateway'
-
-        set container name zabbix-server-mysql port zabbix source 10051
-        set container name zabbix-server-mysql port zabbix destination 10051
-
-        set container name zabbix-web-nginx-mysql image zabbix/zabbix-web-nginx-mysql:alpine-5.2-latest
-        set container name zabbix-web-nginx-mysql network zabbix
-
-        set container name zabbix-web-nginx-mysql environment 'MYSQL_DATABASE' value 'zabbix'
-        set container name zabbix-web-nginx-mysql environment 'ZBX_SERVER_HOST' value 'zabbix-server-mysql'
-        set container name zabbix-web-nginx-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
-        set container name zabbix-web-nginx-mysql environment 'MYSQL_USER' value 'zabbix'
-        set container name zabbix-web-nginx-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
-        set container name zabbix-web-nginx-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
-
-        set container name zabbix-web-nginx-mysql port http source 80
-        set container name zabbix-web-nginx-mysql port http destination 8080
diff --git a/docs/configuration/container/md-index.md b/docs/configuration/container/md-index.md
deleted file mode 100644
index db46db38..00000000
--- a/docs/configuration/container/md-index.md
+++ /dev/null
@@ -1,479 +0,0 @@
----
-lastproofread: '2024-07-03'
----
-
-# Container
-
-The VyOS container implementation is based on [Podman](https://podman.io/) as
-a daemonless container engine.
-
-## Configuration
-
-```{cfgcmd} set container name \<name\> image
-
-Sets the image name in the hub registry
-
-:::{code-block} none
-set container name mysql-server image mysql:8.0
-:::
-
-If a registry is not specified, Docker.io will be used as the container
-registry unless an alternative registry is specified using
-`set container registry <name>` or the registry is included
-in the image name
-
-:::{code-block} none
-set container name mysql-server image quay.io/mysql:8.0
-:::
-```
-
-
-```{cfgcmd} set container name \<name\> entrypoint \<entrypoint\>
-
-Override the default entrypoint from the image for a container.
-```
-
-
-```{cfgcmd} set container name \<name\> command \<command\>
-
-Override the default command from the image for a container.
-```
-
-
-```{cfgcmd} set container name \<name\> arguments \<arguments\>
-
-Set the command arguments for a container.
-```
-
-
-```{cfgcmd} set container name \<name\> host-name \<hostname\>
-
-Set the host name for a container.
-```
-
-
-```{cfgcmd} set container name \<name\> allow-host-pid
-
-The container and the host share the same process namespace.
-This means that processes running on the host are visible inside the
-container, and processes inside the container are visible on the host.
-
-The command translates to "--pid host" when the container is created.
-```
-
-
-```{cfgcmd} set container name \<name\> allow-host-networks
-
-Allow host networking in a container. The network stack of the container is
-not isolated from the host and will use the host IP.
-
-The command translates to "--net host" when the container is created.
-
-:::{note}
-**allow-host-networks** cannot be used with **network**
-:::
-```
-
-
-```{cfgcmd} set container name \<name\> network \<networkname\>
-
-Attaches user-defined network to a container.
-Only one network must be specified and must already exist.
-```
-
-
-```{cfgcmd} set container name \<name\> network \<networkname\> address \<address\>
-
-Optionally set a specific static IPv4 or IPv6 address for the container.
-This address must be within the named network prefix.
-
-:::{note}
-The first IP in the container network is reserved by the
-engine and cannot be used
-:::
-```
-
-
-```{cfgcmd} set container name \<name\> name-server \<address\>
-
-Optionally set a custom name server.
-If a container network is used with DNS enabled,
-this setting will not have any effect.
-```
-
-
-```{cfgcmd} set container name \<name\> description \<text\>
-
-Set a container description
-```
-
-
-```{cfgcmd} set container name \<name\> environment \<key\> value \<value\>
-
-Add custom environment variables.
-Multiple environment variables are allowed.
-The following commands translate to "-e key=value" when the container
-is created.
-
-:::{code-block} none
-set container name mysql-server environment MYSQL_DATABASE value 'zabbix'
-set container name mysql-server environment MYSQL_USER value 'zabbix'
-set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd'
-set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd'
-:::
-```
-
-
-```{cfgcmd} set container name \<name\> port \<portname\> source \<portnumber\>
-
-```
-```{cfgcmd} set container name \<name\> port \<portname\> destination \<portnumber\>
-```
-
-```{cfgcmd} set container name \<name\> port \<portname\> protocol \<tcp | udp\>
-
-Publish a port for the container.
-
-:::{code-block} none
-set container name zabbix-web-nginx-mysql port http source 80
-set container name zabbix-web-nginx-mysql port http destination 8080
-set container name zabbix-web-nginx-mysql port http protocol tcp
-:::
-```
-:::{note}
-Port publishing cannot be used with **network**. For this purpose, a workaround
-using destination NAT and static IP assignment for the container is available.
-:::
-```{cfgcmd} set container name \<name\> volume \<volumename\> source \<path\>
-```
-
-```{cfgcmd} set container name \<name\> volume \<volumename\> destination \<path\>
-
-Mount a volume into the container
-
-:::{code-block} none
-set container name coredns volume 'corefile' source /config/coredns/Corefile
-set container name coredns volume 'corefile' destination /etc/Corefile
-:::
-```
-
-```{cfgcmd} set container name \<name\> volume \<volumename\> mode \<ro | rw\>
-
-Volume is either mounted as rw (read-write - default) or ro (read-only)
-```
-
-```{cfgcmd} set container name \<name\> tmpfs \<tmpfsname\> destination \<path\>
-
-Mount a tmpfs *(ramdisk)* filesystem to the given path within the container.
-```
-
-```{cfgcmd} set container name \<name\> tmpfs \<tmpfsname\> size \<MB\>
-
-Size in MB for tmpfs filesystem, maximum size is 64GB or 50% of the
-systems total available memory.
-```
-
-```{cfgcmd} set container name \<name\> uid \<number\>
-```
-
-```{cfgcmd} set container name \<name\> gid \<number\>
-
-Set the User ID or Group ID of the container
-```
-
-```{cfgcmd} set container name \<name\> restart [no | on-failure | always]
-
-Set the restart behavior of the container.
-
-- **no**: Do not restart containers on exit
-- **on-failure**: Restart containers when they exit with a non-zero
-exit code, retrying indefinitely (default)
-- **always**: Restart containers when they exit, regardless of status,
-retrying indefinitely
-```
-
-```{cfgcmd} set container name \<name\> cpu-quota \<num\>
-
-This specifies the number of CPU resources the container can use.
-
-Default is 0 for unlimited.
-For example, 1.25 limits the container to use up to 1.25 cores
-worth of CPU time.
-This can be a decimal number with up to three decimal places.
-
-The command translates to "--cpus=\<num\>" when the container is created.
-```
-
-```{cfgcmd} set container name \<name\> memory \<MB\>
-
-Constrain the memory available to the container.
-
-Default is 512 MB. Use 0 MB for unlimited memory.
-```
-
-```{cfgcmd} set container name \<name\> device \<devicename\> source \<path\>
-```
-
-```{cfgcmd} set container name \<name\> device \<devicename\> destination \<path\>
-
-Add a host device to the container.
-```
-
-```{cfgcmd} set container name \<name\> capability \<text\>
-
-Set container capabilities or permissions.
-
-- **net-admin**: Network operations (interface, firewall, routing tables)
-- **net-bind-service**: Bind a socket to privileged ports
-(port numbers less than 1024)
-- **net-raw**: Permission to create raw network sockets
-- **setpcap**: Capability sets (from bounded or inherited set)
-- **sys-admin**: Administration operations (quotactl, mount, sethostname,
-setdomainame)
-- **sys-time**: Permission to set system clock
-```
-
-```{cfgcmd} set container name \<name\> sysctl parameter \<parameter\> value \<value\>
-
-Set container sysctl values.
-
-The subset of possible parameters are:
-
-- Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem,
-kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced
-- Parameters beginning with fs.mqueue.*
-- Parameters beginning with net.* (only if user-defined network is used)
-```
-
-```{cfgcmd} set container name \<name\> label \<label\> value \<value\>
-
-Add metadata label for this container.
-```
-
-```{cfgcmd} set container name \<name\> disable
-
-Disable a container.
-```
-
-### Container Health checks
-
-
-By default, no health checks are run, even when defined by the image.
-
-```{cfgcmd} set container name \<name\> health-check
-
-Default health check is run for the container if defined by the image.
-```
-
-```{cfgcmd} set container name \<name\> health-check command \<command\>
-
-Override the default health check command from the image for a container.
-```
-
-```{cfgcmd} set container name \<name\> health-check interval \<interval\>
-
-Override the default health-check interval. For example: `60`
-```
-
-```{cfgcmd} set container name \<name\> health-check timeout \<timeout\>
-
-Override the default health-check timeout. For example: `10`
-```
-
-```{cfgcmd} set container name \<name\> health-check retries \<retries\>
-
-Number of health check retries before container is considered unhealthy. For example: `1`
-```
-
-### Container Networks
-
-```{cfgcmd} set container network \<name\>
-
-Creates a named container network
-```
-
-```{cfgcmd} set container network \<name\> description
-
-A brief description what this network is all about.
-```
-
-```{cfgcmd} set container network \<name\> prefix \<ipv4|ipv6\>
-
-Define IPv4 and/or IPv6 prefix for a given network name.
-Both IPv4 and IPv6 can be used in parallel.
-```
-
-```{cfgcmd} set container network \<name\> mtu \<number\>
-
-Configure {abbr}`MTU (Maximum Transmission Unit)` for a given network. It
-is the size (in bytes) of the largest ethernet frame sent on this link.
-```
-
-```{cfgcmd} set container network \<name\> no-name-server
-
-Disable Domain Name System (DNS) plugin for this network.
-```
-
-```{cfgcmd} set container network \<name\> vrf \<name\>
-
-Bind container network to a given VRF instance.
-```
-
-### Container Registry
-
-```{cfgcmd} set container registry \<name\>
-
-Adds registry to list of unqualified-search-registries. By default, for any
-image that does not include the registry in the image name, VyOS will use
-docker.io and quay.io as the container registry.
-```
-
-```{cfgcmd} set container registry \<name\> disable
-
-Disable a given container registry
-```
-
-```{cfgcmd} set container registry \<name\> authentication username
-```
-
-```{cfgcmd} set container registry \<name\> authentication password
-
-Some container registries require credentials to be used.
-
-Credentials can be defined here and will only be used when adding a
-container image to the system.
-```
-
-```{cfgcmd} set container registry \<name\> insecure
-
-Allow registry access over unencrypted HTTP or TLS connections with
-untrusted certificates.
-```
-
-```{cfgcmd} set container registry \<name\> mirror address \<address\>
-```
-
-```{cfgcmd} set container registry \<name\> mirror host-name \<host-name\>
-```
-
-```{cfgcmd} set container registry \<name\> mirror port \<port\>
-```
-
-```{cfgcmd} set container registry \<name\> mirror path \<path\>
-
-Registry mirror, use ``(host-name|address)[:port][/path]``.
-
-If you have mirror http://192.168.1.1:8080 for docker.io, you can use ``docker.io/some/repo`` or run ``podman pull docker.io/some/repo``
-
-:::{code-block} none
-set container registry docker.io mirror address 192.168.1.1
-set container registry docker.io mirror port 8080
-set container registry docker.io insecure
-:::
-If http://192.168.1.1:8080 is your own registry, you can use ``192.168.1.1:8080/some/repo`` or run ``podman pull 192.168.1.1:8080/some/repo``
-
-:::{code-block} none
-set container registry 192.168.1.1:8080 insecure
-:::
-```
-
-### Log Configuration
-
-```{cfgcmd} set container name \<name\> log-driver [k8s-file | journald | none]
-
-Set the default log driver for containers.
-
-- **k8s-file**: Log to a plain text file in Kubernetes-style format.
-- **journald**: Log to the system journal
-- **none**: Disable logging for the container
-
-Current default is journald.
-
-```
-
-## Operation Commands
-
-```{opcmd} add container image \<containername\>
-
-Pull a new image for container
-```
-```{opcmd} show container
-
-Show the list of all active containers.
-```
-```{opcmd} show container image
-
-Show the local container images.
-```
-```{opcmd} show container log \<containername\>
-
-Show logs from a given container
-```
-```{opcmd} show container network
-
-Show a list available container networks
-```
-```{opcmd} restart container \<containername\>
-
-Restart a given container
-```
-```{opcmd} update container image \<containername\>
-
-Update container image
-```
-```{opcmd} delete container image \<image id|all\> [force]
-
-Delete a particular container image based on it's image ID.
-You can also delete all container images at once.
-
-You can not delete a container image if it has more then one tag
-assigned, this is why there is a `force` option to pass down to
-the container image to also remove those images.
-```
-
-## Example Configuration
-
-For the sake of demonstration, [example #1 in the official documentation](https://www.zabbix.com/documentation/current/manual/installation/containers)
-to the declarative VyOS CLI syntax.
-
-```none
-set container network zabbix prefix 172.20.0.0/16
-set container network zabbix description 'Network for Zabbix component containers'
-
-set container name mysql-server image mysql:8.0
-set container name mysql-server network zabbix
-
-set container name mysql-server environment 'MYSQL_DATABASE' value 'zabbix'
-set container name mysql-server environment 'MYSQL_USER' value 'zabbix'
-set container name mysql-server environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
-set container name mysql-server environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
-
-set container name zabbix-java-gateway image zabbix/zabbix-java-gateway:alpine-5.2-latest
-set container name zabbix-java-gateway network zabbix
-
-set container name zabbix-server-mysql image zabbix/zabbix-server-mysql:alpine-5.2-latest
-set container name zabbix-server-mysql network zabbix
-
-set container name zabbix-server-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
-set container name zabbix-server-mysql environment 'MYSQL_DATABASE' value 'zabbix'
-set container name zabbix-server-mysql environment 'MYSQL_USER' value 'zabbix'
-set container name zabbix-server-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
-set container name zabbix-server-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
-set container name zabbix-server-mysql environment 'ZBX_JAVAGATEWAY' value 'zabbix-java-gateway'
-
-set container name zabbix-server-mysql port zabbix source 10051
-set container name zabbix-server-mysql port zabbix destination 10051
-
-set container name zabbix-web-nginx-mysql image zabbix/zabbix-web-nginx-mysql:alpine-5.2-latest
-set container name zabbix-web-nginx-mysql network zabbix
-
-set container name zabbix-web-nginx-mysql environment 'MYSQL_DATABASE' value 'zabbix'
-set container name zabbix-web-nginx-mysql environment 'ZBX_SERVER_HOST' value 'zabbix-server-mysql'
-set container name zabbix-web-nginx-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
-set container name zabbix-web-nginx-mysql environment 'MYSQL_USER' value 'zabbix'
-set container name zabbix-web-nginx-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
-set container name zabbix-web-nginx-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
-
-set container name zabbix-web-nginx-mysql port http source 80
-set container name zabbix-web-nginx-mysql port http destination 8080
-```
diff --git a/docs/configuration/container/rst-index.rst b/docs/configuration/container/rst-index.rst
new file mode 100644
index 00000000..398f1941
--- /dev/null
+++ b/docs/configuration/container/rst-index.rst
@@ -0,0 +1,417 @@
+:lastproofread: 2024-07-03
+
+#########
+Container
+#########
+
+The VyOS container implementation is based on `Podman <https://podman.io/>`_ as
+a deamonless container engine.
+
+*************
+Configuration
+*************
+
+.. cfgcmd:: set container name <name> image
+
+    Sets the image name in the hub registry
+
+    .. code-block:: none
+
+      set container name mysql-server image mysql:8.0
+
+    If a registry is not specified, Docker.io will be used as the container
+    registry unless an alternative registry is specified using
+    **set container registry <name>** or the registry is included
+    in the image name
+
+    .. code-block:: none
+
+      set container name mysql-server image quay.io/mysql:8.0
+
+.. cfgcmd:: set container name <name> entrypoint <entrypoint>
+
+   Override the default entrypoint from the image for a container.
+
+.. cfgcmd:: set container name <name> command <command>
+
+    Override the default command from the image for a container.
+
+.. cfgcmd:: set container name <name> arguments <arguments>
+
+    Set the command arguments for a container.
+
+.. cfgcmd:: set container name <name> host-name <hostname>
+
+    Set the host name for a container.
+
+.. cfgcmd:: set container name <name> allow-host-pid
+
+    The container and the host share the same process namespace.
+    This means that processes running on the host are visible inside the
+    container, and processes inside the container are visible on the host.
+
+    The command translates to "--pid host" when the container is created.
+
+.. cfgcmd:: set container name <name> allow-host-networks
+
+    Allow host networking in a container. The network stack of the container is
+    not isolated from the host and will use the host IP.
+
+    The command translates to "--net host" when the container is created.
+
+    .. note:: **allow-host-networks** cannot be used with **network**
+
+.. cfgcmd:: set container name <name> network <networkname>
+
+    Attaches user-defined network to a container.
+    Only one network must be specified and must already exist.
+
+.. cfgcmd:: set container name <name> network <networkname> address <address>
+
+    Optionally set a specific static IPv4 or IPv6 address for the container.
+    This address must be within the named network prefix.
+
+    .. note:: The first IP in the container network is reserved by the
+       engine and cannot be used
+
+.. cfgcmd:: set container name <name> name-server <address>
+
+    Optionally set a custom name server.
+    If a container network is used with DNS enabled,
+    this setting will not have any effect.
+
+.. cfgcmd:: set container name <name> description <text>
+
+    Set a container description
+
+.. cfgcmd:: set container name <name> environment <key> value <value>
+
+    Add custom environment variables.
+    Multiple environment variables are allowed.
+    The following commands translate to "-e key=value" when the container
+    is created.
+
+    .. code-block:: none
+
+        set container name mysql-server environment MYSQL_DATABASE value 'zabbix'
+        set container name mysql-server environment MYSQL_USER value 'zabbix'
+        set container name mysql-server environment MYSQL_PASSWORD value 'zabbix_pwd'
+        set container name mysql-server environment MYSQL_ROOT_PASSWORD value 'root_pwd'
+
+.. cfgcmd:: set container name <name> port <portname> source <portnumber>
+.. cfgcmd:: set container name <name> port <portname> destination <portnumber>
+.. cfgcmd:: set container name <name> port <portname> protocol <tcp | udp>
+
+    Publish a port for the container.
+
+    .. code-block:: none
+
+        set container name zabbix-web-nginx-mysql port http source 80
+        set container name zabbix-web-nginx-mysql port http destination 8080
+        set container name zabbix-web-nginx-mysql port http protocol tcp
+
+.. note:: Port publishing cannot be used with **network**. For this purpose, a workaround
+          using destination NAT and static IP assignment for the container is available.
+
+.. cfgcmd:: set container name <name> volume <volumename> source <path>
+.. cfgcmd:: set container name <name> volume <volumename> destination <path>
+
+    Mount a volume into the container
+
+    .. code-block:: none
+
+        set container name coredns volume 'corefile' source /config/coredns/Corefile
+        set container name coredns volume 'corefile' destination /etc/Corefile
+
+.. cfgcmd:: set container name <name> volume <volumename> mode <ro | rw>
+
+    Volume is either mounted as rw (read-write - default) or ro (read-only)
+
+.. cfgcmd:: set container name <name> tmpfs <tmpfsname> destination <path>
+
+    Mount a tmpfs *(ramdisk)* filesystem to the given path within the container.
+
+.. cfgcmd:: set container name <name> tmpfs <tmpfsname> size <MB>
+
+    Size in MB for tmpfs filesystem, maximum size is 64GB or 50% of the
+    systems total available memory.
+
+.. cfgcmd:: set container name <name> uid <number>
+.. cfgcmd:: set container name <name> gid <number>
+
+    Set the User ID or Group ID of the container
+
+.. cfgcmd:: set container name <name> restart [no | on-failure | always]
+
+   Set the restart behavior of the container.
+
+   - **no**: Do not restart containers on exit
+   - **on-failure**: Restart containers when they exit with a non-zero
+     exit code, retrying indefinitely (default)
+   - **always**: Restart containers when they exit, regardless of status,
+     retrying indefinitely
+
+.. cfgcmd:: set container name <name> cpu-quota <num>
+
+   This specifies the number of CPU resources the container can use.
+
+   Default is 0 for unlimited.
+   For example, 1.25 limits the container to use up to 1.25 cores
+   worth of CPU time.
+   This can be a decimal number with up to three decimal places.
+
+   The command translates to "--cpus=<num>" when the container is created.
+
+.. cfgcmd:: set container name <name> memory <MB>
+
+   Constrain the memory available to the container.
+
+   Default is 512 MB. Use 0 MB for unlimited memory.
+
+.. cfgcmd:: set container name <name> device <devicename> source <path>
+.. cfgcmd:: set container name <name> device <devicename> destination <path>
+
+   Add a host device to the container.
+
+.. cfgcmd:: set container name <name> capability <text>
+
+   Set container capabilities or permissions.
+
+   - **net-admin**: Network operations (interface, firewall, routing tables)
+   - **net-bind-service**: Bind a socket to privileged ports
+     (port numbers less than 1024)
+   - **net-raw**: Permission to create raw network sockets
+   - **setpcap**: Capability sets (from bounded or inherited set)
+   - **sys-admin**: Administration operations (quotactl, mount, sethostname,
+     setdomainame)
+   - **sys-time**: Permission to set system clock
+
+.. cfgcmd:: set container name <name> sysctl parameter <parameter> value <value>
+
+   Set container sysctl values.
+
+   The subset of possible parameters are:
+
+   - Kernel Parameters: kernel.msgmax, kernel.msgmnb, kernel.msgmni, kernel.sem,
+     kernel.shmall, kernel.shmmax, kernel.shmmni, kernel.shm_rmid_forced
+   - Parameters beginning with fs.mqueue.*
+   - Parameters beginning with net.* (only if user-defined network is used)
+
+.. cfgcmd:: set container name <name> label <label> value <value>
+
+   Add metadata label for this container.
+
+.. cfgcmd:: set container name <name> disable
+
+   Disable a container.
+
+Container Health checks
+=======================
+
+By default, no health checks are run, even when defined by the image.
+
+.. cfgcmd:: set container name <name> health-check
+
+    Default health check is run for the container if defined by the image.
+
+.. cfgcmd:: set container name <name> health-check command <command>
+
+    Override the default health check command from the image for a container.
+
+.. cfgcmd:: set container name <name> health check interval <interval>
+
+    Override the default health-check interval. For example: `60`
+
+.. cfgcmd:: set container name <name> health check timeout <timeout>
+
+    Override the default health-check timeout. For example: `10`
+
+.. cfgcmd:: set container name <name> health check retries <retries>
+
+    Number of health check retries before container is considered unhealthy. For example: `1`
+
+Container Networks
+==================
+
+.. cfgcmd:: set container network <name>
+
+    Creates a named container network
+
+.. cfgcmd:: set container network <name> description
+
+    A brief description what this network is all about.
+
+.. cfgcmd:: set container network <name> prefix <ipv4|ipv6>
+
+    Define IPv4 and/or IPv6 prefix for a given network name.
+    Both IPv4 and IPv6 can be used in parallel.
+
+.. cfgcmd:: set container network <name> mtu <number>
+
+    Configure :abbr:`MTU (Maximum Transmission Unit)` for a given network. It
+    is the size (in bytes) of the largest ethernet frame sent on this link.
+
+.. cfgcmd:: set container network <name> no-name-server
+
+    Disable Domain Name System (DNS) plugin for this network.
+
+.. cfgcmd:: set container network <name> vrf <nme>
+
+    Bind container network to a given VRF instance.
+
+Container Registry
+==================
+
+.. cfgcmd:: set container registry <name>
+
+    Adds registry to list of unqualified-search-registries. By default, for any
+    image that does not include the registry in the image name, VyOS will use
+    docker.io and quay.io as the container registry.
+
+.. cfgcmd:: set container registry <name> disable
+
+    Disable a given container registry
+
+.. cfgcmd:: set container registry <name> authentication username
+.. cfgcmd:: set container registry <name> authentication password
+
+    Some container registries require credentials to be used.
+
+    Credentials can be defined here and will only be used when adding a
+    container image to the system.
+
+.. cfgcmd:: set container registry <name> insecure
+
+    Allow registry access over unencrypted HTTP or TLS connections with
+    untrusted certificates.
+
+.. cfgcmd:: set container registry <name> mirror address <address>
+
+.. cfgcmd:: set container registry <name> mirror host-name <host-name>
+
+.. cfgcmd:: set container registry <name> mirror port <port>
+
+.. cfgcmd:: set container registry <name> mirror path <path>
+
+    Registry mirror, use ``(host-name|address)[:port][/path]``.
+
+    If you have mirror http://192.168.1.1:8080 for docker.io, you can use ``docker.io/some/repo`` or run ``podman pull docker.io/some/repo``
+
+    .. code-block:: none
+
+        set container registry docker.io mirror address 192.168.1.1
+        set container registry docker.io mirror port 8080
+        set container registry docker.io insecure
+
+    If http://192.168.1.1:8080 is your own registry, you can use ``192.168.1.1:8080/some/repo`` or run ``podman pull 192.168.1.1:8080/some/repo``
+
+    .. code-block:: none
+
+        set container registry 192.168.1.1:8080 insecure
+
+
+Log Configuration
+====================
+
+.. cfgcmd:: set container name <name> log-driver [k8s-file | journald | none]
+
+   Set the default log driver for containers.
+
+   - **k8s-file**: Log to a plain text file in Kubernetes-style format.
+   - **journald**: Log to the system journal
+   - **none**: Disable logging for the container
+
+   Current default is journald. 
+
+
+******************
+Operation Commands
+******************
+
+.. opcmd:: add container image <containername>
+
+    Pull a new image for container
+
+.. opcmd:: show container
+
+    Show the list of all active containers.
+
+.. opcmd:: show container image
+
+    Show the local container images.
+
+.. opcmd:: show container log <containername>
+
+    Show logs from a given container
+
+.. opcmd:: show container network
+
+    Show a list available container networks
+
+.. opcmd:: restart container <containername>
+
+    Restart a given container
+
+.. opcmd:: update container image <containername>
+
+    Update container image
+
+.. opcmd:: delete container image <image id|all> [force]
+
+    Delete a particular container image based on it's image ID.
+    You can also delete all container images at once.
+
+    You can not delete a container image if it has more then one tag
+    assigned, this is why there is a `force` option to pass down to
+    the container image to also remove those images.
+
+*********************
+Example Configuration
+*********************
+
+    For the sake of demonstration, `example #1 in the official documentation
+    <https://www.zabbix.com/documentation/current/manual/
+    installation/containers>`_
+    to the declarative VyOS CLI syntax.
+
+    .. code-block:: none
+
+        set container network zabbix prefix 172.20.0.0/16
+        set container network zabbix description 'Network for Zabbix component containers'
+
+        set container name mysql-server image mysql:8.0
+        set container name mysql-server network zabbix
+
+        set container name mysql-server environment 'MYSQL_DATABASE' value 'zabbix'
+        set container name mysql-server environment 'MYSQL_USER' value 'zabbix'
+        set container name mysql-server environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
+        set container name mysql-server environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
+
+        set container name zabbix-java-gateway image zabbix/zabbix-java-gateway:alpine-5.2-latest
+        set container name zabbix-java-gateway network zabbix
+
+        set container name zabbix-server-mysql image zabbix/zabbix-server-mysql:alpine-5.2-latest
+        set container name zabbix-server-mysql network zabbix
+
+        set container name zabbix-server-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
+        set container name zabbix-server-mysql environment 'MYSQL_DATABASE' value 'zabbix'
+        set container name zabbix-server-mysql environment 'MYSQL_USER' value 'zabbix'
+        set container name zabbix-server-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
+        set container name zabbix-server-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
+        set container name zabbix-server-mysql environment 'ZBX_JAVAGATEWAY' value 'zabbix-java-gateway'
+
+        set container name zabbix-server-mysql port zabbix source 10051
+        set container name zabbix-server-mysql port zabbix destination 10051
+
+        set container name zabbix-web-nginx-mysql image zabbix/zabbix-web-nginx-mysql:alpine-5.2-latest
+        set container name zabbix-web-nginx-mysql network zabbix
+
+        set container name zabbix-web-nginx-mysql environment 'MYSQL_DATABASE' value 'zabbix'
+        set container name zabbix-web-nginx-mysql environment 'ZBX_SERVER_HOST' value 'zabbix-server-mysql'
+        set container name zabbix-web-nginx-mysql environment 'DB_SERVER_HOST' value 'mysql-server'
+        set container name zabbix-web-nginx-mysql environment 'MYSQL_USER' value 'zabbix'
+        set container name zabbix-web-nginx-mysql environment 'MYSQL_PASSWORD' value 'zabbix_pwd'
+        set container name zabbix-web-nginx-mysql environment 'MYSQL_ROOT_PASSWORD' value 'root_pwd'
+
+        set container name zabbix-web-nginx-mysql port http source 80
+        set container name zabbix-web-nginx-mysql port http destination 8080
-- 
cgit v1.2.3