Программное обеспечение расширенного репозитория является сторонним по отношению к Astra Linux, не дорабатывается с точки зрения выполнения требований по безопасности информации и не проверяется при сертификации.
Подробнее см. Использование стороннего программного обеспечения в аттестованных информационных системах, функционирующих под управлением Astra Linux Special Edition.

При использовании программного обеспечения расширенного репозитория рекомендуется для дополнительной изоляции процессов осуществлять их запуск в изолированной программной среде (контейнере) [п. 7.2 РукКСЗ1]. При использовании для этих целей Docker-контейнеров их запуск целесообразно осуществлять от имени непривилегированного пользователя в rootless-режиме, а при включенном мандатном контроле целостности (МКЦ) с применением технологии запуска контейнеров на пониженном [п. 7.2.1] или выделенном [п. 7.2.7] уровне МКЦ.

Manage pods, containers and images

Usage:
  podman [options] [command]

Available Commands:
  attach      Attach to a running container
  auto-update Auto update containers according to their auto-update policy
  build       Build an image using instructions from Containerfiles
  commit      Create new image based on the changed container
  container   Manage containers
  cp          Copy files/folders between a container and the local filesystem
  create      Create but do not start a container
  diff        Display the changes to the object's file system
  events      Show podman events
  exec        Run a process in a running container
  export      Export container's filesystem contents as a tar archive
  generate    Generate structured data based on containers, pods or volumes
  healthcheck Manage health checks on containers
  help        Help about any command
  history     Show history of a specified image
  image       Manage images
  images      List images in local storage
  import      Import a tarball to create a filesystem image
  info        Display podman system information
  init        Initialize one or more containers
  inspect     Display the configuration of object denoted by ID
  kill        Kill one or more running containers with a specific signal
  kube        Play containers, pods or volumes from a structured file
  load        Load image(s) from a tar archive
  login       Login to a container registry
  logout      Logout of a container registry
  logs        Fetch the logs of one or more containers
  machine     Manage a virtual machine
  manifest    Manipulate manifest lists and image indexes
  mount       Mount a working container's root filesystem
  network     Manage networks
  pause       Pause all the processes in one or more containers
  pod         Manage pods
  port        List port mappings or a specific mapping for the container
  ps          List containers
  pull        Pull an image from a registry
  push        Push an image to a specified destination
  rename      Rename an existing container
  restart     Restart one or more containers
  rm          Remove one or more containers
  rmi         Removes one or more images from local storage
  run         Run a command in a new container
  save        Save image(s) to an archive
  search      Search registry for image
  secret      Manage secrets
  start       Start one or more containers
  stats       Display a live stream of container resource usage statistics
  stop        Stop one or more containers
  system      Manage podman
  tag         Add an additional name to a local image
  top         Display the running processes of a container
  unmount     Unmounts working container's root filesystem
  unpause     Unpause the processes in one or more containers
  unshare     Run a command in a modified user namespace
  untag       Remove a name from a local image
  update      update an existing container
  version     Display the Podman version information
  volume      Manage volumes
  wait        Block on one or more containers

Options:
      --cgroup-manager string       Cgroup manager to use ("cgroupfs"|"systemd") (default "systemd")
      --conmon string               Path of the conmon binary
  -c, --connection string           Connection to use for remote Podman service
      --events-backend string       Events backend to use ("file"|"journald"|"none") (default "file")
      --help                        Help for podman
      --hooks-dir strings           Set the OCI hooks directory path (may be set multiple times) (default [/usr/share/containers/oci/hooks.d])
      --identity string             path to SSH identity file, (CONTAINER_SSHKEY)
      --log-level string            Log messages above specified level (trace, debug, info, warn, warning, error, fatal, panic) (default "warn")
      --namespace string            Set the libpod namespace, used to create separate views of the containers and pods on the system
      --network-cmd-path string     Path to the command for configuring the network
      --network-config-dir string   Path of the configuration directory for networks
      --noout                       do not output to stdout
  -r, --remote                      Access remote Podman service
      --root string                 Path to the root directory in which data, including images, is stored
      --runroot string              Path to the 'run directory' where all state information is stored
      --runtime string              Path to the OCI-compatible binary used to run containers. (default "runc")
      --runtime-flag stringArray    add global flags for the container runtime
      --ssh string                  define the ssh mode (default "golang")
      --storage-driver string       Select which storage driver is used to manage storage of images and containers
      --storage-opt stringArray     Used to pass an option to the storage driver
      --syslog                      Output logging information to syslog as well as the console (default false)
      --tmpdir string               Path to the tmp directory for libpod state content.
                                    
                                    Note: use the environment variable 'TMPDIR' to change the temporary storage location for container images, '/var/tmp'.
                                    
      --url string                  URL to access Podman service (CONTAINER_HOST) (default "unix:/run/user/1000/podman/podman.sock")
  -v, --version                     version for podman
      --volumepath string           Path to the volume directory in which volume data is stored

unqualified-search-registries = [ 'registry.redhat.io', 'docker.io']

podman images

REPOSITORY                           TAG         IMAGE ID      CREATED      SIZE
registry.astralinux.ru/library/alse  1.7.4       557b8fe356eb  7 weeks ago  98.4 MB

podman run -it --rm registry.astralinux.ru/library/alse:1.7.4 /bin/bash

podman run -d <имя_образа>

podman run --mount type=bind,source=<монтируемый_каталог>,target=<точка_монтирования> <имя_образа>

podman ps

podman ps -a

CONTAINER ID  IMAGE                                      COMMAND     CREATED         STATUS                    PORTS       NAMES
0468d9f62e2d  registry.astralinux.ru/library/alse:1.7.4  /bin/bash   12 seconds ago  Exited (0) 5 seconds ago              priceless_hertz

podman start <идентификатор_контейнера>

podman stop <идентификатор_контейнера>

Перед удалением контейнер должен быть остановлен.

podman rm <идентификатор_контейнера>

podman inspect <идентификатор_контейнера>

podman inspect <идентификатор_контейнера> --format '{{.NetworkSettings.IPAddress}}'

podman logs <идентификатор_контейнера>

podman stats

podman stats --no-stream

Для удаления образа предварительно необходимо остановить и удалить все созданные из него контейнеры.

podman rmi <идентификатор_образа>

Для применения сценария требуется установить пакет debootstrap:

#!/bin/sh
if [ -z $REPO ]; then
    REPO="https://dl.astralinux.ru/astra/stable/orel/repository"
fi
set -e

IMAGE="${IMAGE:-astra_linux_ce_2.12}"
ROOTFS_IMAGE="$IMAGE-rootfs"
CODENAME="${CODENAME:-orel}"

TMPDIR=`mktemp -d`
cd $TMPDIR

cleanup() {
    cd $HOME
# debootstrap leaves mounted /proc and /sys folders in chroot when terminated by Ctrl-C
    sudo umount $TMPDIR/proc $TMPDIR/sys 2>&1 >/dev/null || true
# Delete temporary data at exit
    sudo rm -rf $TMPDIR
}
trap cleanup EXIT

sudo -E debootstrap --no-check-gpg --variant=minbase --include=apt-transport-https,ca-certificates \
--components=main,contrib,non-free "$CODENAME" ./chroot "$REPO"
echo "deb $REPO $CODENAME contrib main non-free" | sudo tee ./chroot/etc/apt/sources.list
podman rmi "$ROOTFS_IMAGE" || true
sudo tar -C chroot -c . | podman import - "$ROOTFS_IMAGE"
podman rmi "$IMAGE" || true
podman build --network=host --no-cache=true -t "$IMAGE" - <<EOF
FROM $ROOTFS_IMAGE
ENV TERM xterm-256color
ENV DEBIAN_FRONTEND noninteractive
RUN apt-get update
WORKDIR /
CMD bash
EOF

printf 'podman image `%s` has been generated\n' "$IMAGE"
exit 0