Chapter 3. Atomic Commands 3.1. atomic host This subcommand is a high-level wrapper for the rpm-ostree , tool which performs upgrades, rollbacks, and system state inspection. atomic host status Lists information about all deployments. The asterisk ( * ) marks the currently running deployment. atomic host rollback Switches to the other installed tree at the boot. You can use the -r option to initiate a reboot after rollback is prepared: atomic host upgrade Upgrades to the latest OSTree if available. This can take a few minutes. When done, it gives you a full list of changed , removed , and added packages. The newly downloaded tree boots automatically at reboot. atomic host deploy Allows you to specify a particular version of an OSTree and deploy it. This command is more flexible than upgrade or rollback , as they only alternate between the two installed OSTrees. The newly downloaded tree replaces the one that is not currently deployed. The syntax is as follows: For example, use this command to deploy the 7.2.1 OSTree and initiate a reboot after the tree is downloaded: Use the --preview option to check the package difference between your currently deployed tree and a specified one: If you are unsure about the version numbering, pull the commit history for the repository you are subscribed to by using the following ostree commands: When you have the version number you are interested in you can use the atomic host <version> --preview command to check the package differences. You can have at most two deployments on the system. upgrade or deploy downloads a new tree and replaces the currently not deployed one. You can then alternate between both trees on the system with rollback . You can also use the commit ID of a particular version. The following Solution from the Customer Portal contains a list of all commit IDs that have been released: Deploying a specific version of Red Hat Enterprise Linux Atomic Host . 3.2. atomic diff Compares two images or containers at a file level and displays a full list of their differences. By default, a full list of files is displayed. You can modify the output with a combination of several options. The --rpms option adds a table with differences between the RPMs in the two images. Combined with the --no-files option you can restrict the output to only print that table. Warning Do not use the --no-files option on its own as it will not produce any output. The --names-only option compares package names only, without versions. It is a good idea to redirect the output to a text viewer such as less , as the full list of files can get too long and the terminal will truncate it. Use the --json option to print the output in JSON format and redirect it, for example, with less : 3.3. atomic install Executes an image's install method. The install method is described in the LABEL INSTALL field in the container image. It is typically used to prepare the host system to run the image. It often exposes configuration files needed for the image to the host so they can be edited and saved if the image is deleted. For example, this install method: executes the following command: With this instruction, atomic install mounts files from the root directory ( / ) on the host to the /host/ directory inside the container and sets the USDHOST variable as /host/ inside the container. For example, /usr/bin is /host/usr/bin in the container, USDIMAGE is rhel7/rsyslog and USDNAME is rsyslog . The /bin/install.sh script exposes the /etc/rsyslog.conf file to the host system so you can edit it from outside the container. If you do not have the image locally, atomic install pulls the image from a configured registry. Use the --display option to show the image's install method. The install command does not execute if --display is specified. Use the -n option to install multiple copies of an image: 3.4. atomic uninstall Similar to install , uninstall reads and executes an image's uninstall method from the UNINSTALL instruction. 3.5. atomic run Executes an image's run method. The run method is described in the RUN field in the container image. RUN allows a developer to define how the particular application should be run. For example, a container with the ntpd service requires the --cap_add SYS_TIME option, and the option can be embedded into the RUN label instead of the user typing the following full command: If the RUN field does not exist, atomic run defaults to running the following: Use the --spc option to run a container in super-privileged mode. You can read more about Super-Privileged Containers here: Chapter 9. Running Super-privileged Containers from the RHEL Atomic Host Getting Started with Containers Guide. 3.6. atomic stop Executes an image's stop method. Use this command to stop running containers. Takes the image name or container name as argument. For example: or 3.7. atomic images Executes commands on images. You can view your images, display LABEL info or their help file, check for newer versions atomic images list Lists the container images you have downloaded on your system. The > symbol indicates that the image is being used by a container. atomic images delete Delete a specified image from your system. By default, you won't be able to delete an image which has containers based on it. Use the -f option to force remove that image. This will not stop the running container based on that image. Use the --remote option to delete an image from a remote repository. However, the remote disk space will not be free until the registry garbage-collection command is run for the remote registry. atomic images info Shows labels defined for the image. By default, it checks in local images first and then tries the registries configured on the system. Use the --remote option to ignore the local images and look only in the configured registries: Use the --storage option to specify the storage of the image. atomic images prune Use atomic images prune to free disk space by deleting unused dangling images. Dangling images are those with no name or tag and that are not used by any other images. Since they are not used, they occupy system space. Dangling images are usually caused by using the docker build command to update an image without also removing the older version of the image. An asterisk ( * ) indicates a dangling image: atomic images verify Checks if there is a newer image available. It also scans through all layers to see if any of the sublayers have a new version available. Use the -v option to print information for every layer. Use the --storage option to specify the storage of the image. Use the --no-validate option to disable validating system images. atomic images version Displays the "Name Version Release" label of an image. 3.8. atomic containers Executes commands on containers. With this command and the subcommands you can list the currently running containers, delete or trim them. atomic containers list Lists all running containers on the system with information about them, including which runtime a container is using, Docker , or runc ( docker ps lists only the Docker-formatted containers). atomic containers list -a will show all containers: atomic containers list also supports filtering the output with the -f option. The filters are: container ID , image , command , created , status , runtime . For example: atomic containers update atomic containers update lets you update a container, if a more recent one is available to be pulled. For example: atomic containers delete Deletes a specified container. For example: atomic containers trim This command discards unused blocks from running containers. It uses the fstrim command that discards blocks which are not used by the file system. It is especially usesful for Thinly-Provisioned storage which is the option used on RHEL Atomic Host. Use this command about once a week to clean up the system from unused file system blocks. For more detailed information, see the fstrim(8) manual page. 3.9. atomic info The atomic info command has been moved under the atomic images set of commands. See Section 3.7, "atomic images" for the description of atomic images info . 3.10. atomic top Displays an interactive view of the processes running in active containers, like the top utility. By default, atomic top monitors all containers, but you can optionally specify only the containers you want by using the container name or ID. The table with default fields looks like this: You can sort the processes by pressing the key in the parenthesis from the column headers. For example, press "P" to sort processes by PID. With this command, you can monitor processes on a five second interval for three iterations. To add add more fields to the default ones, use the --optional option, for example parent PIDs and UID: 3.11. atomic mount Mounts the underlying file system of a container or image into the host file system. This way you can inspect their contents. For example, you can use it to check configuration files. Accepts one of image UUID, container UUID, container NAME, or image REPO (optionally with registry and tag information). If the given UUID or NAME is a container, and the --live option is not set, then atomic mount creates a snapshot of the container by committing it to a temporary image and spawning a temporary container from that image. If UUID or REPO refers to an image, then atomic mount creates a temporary container from the given image. All temporary artifacts are cleaned upon unmounting. Note atomic mount is only supported on the devicemapper and overlayfs storage backends. 3.12. atomic unmount Unmounts a container or image previously mounted with atomic mount . 3.13. atomic pull Fetches an image from a repository and downloads it to the system: You can also specify the source using the source:image format. These are the following options for source : oci : fetches an image from a Docker registry using the skopeo tool. This is the default option that is assumed when no source is specified. You can change the default by editing the /etc/atomic.conf file with the default_storage keyword. docker : imports an image from a local Docker registry, not accessing the network. It is equivalent to saving the image from docker (docker save IMAGE) and importing it into the OSTree repository: dockertar : imports a tarball from a local Docker registry ostree : fetches an image from a remote OSTree repository. The remote has to be already configured in the local OSTree repository: Use the --storage option to specify a destination storage for the image. The two options are docker and ostree . If unspecified, the command assumes it is docker . Use the ostree option when pulling system container images: Use the --type option to specify a different registry type. You can switch to an atomic type of registry. For example: 3.14. atomic push Pushes an image you have built locally to a repository. The default behavior is to push to a docker repository, but can also be set to push to a Satellite or Pulp repository with the --satellite or --pulp options. 3.15. atomic storage (migrate) Manages container storage. atomic storage export/import With the export and import commands, you can migrate all images, volumes, and containers from one version of atomic to another, or from one storage backend to another. With atomic export you can save all data from the current atomic instance, change the environment, and then import all their old data to the new system with atomic import . This command was previously called "migrate". Will export all current images, volumes, and containers to /var/lib/atomic/migrate/ (or another specified directory), under the /images/ , /volumes/ , and /containers/ subdirectories. Will import the images, volumes, and containers previously saved in /var/lib/atomic/migrate/ , or another specified directory into the new atomic instance. If you are running docker from a custom location (not /var/lib/docker/ ), you must set the --graph option pointing to the custom location. To save the data in a non-standard directory, use the --dir option. atomic storage modify Modifies the default storage setup. You can add a block device to the storage pool. This command expands your devicemapper storage pool by adding the block device. Only works with devicemapper driver. For example: To change the backend storage driver, use the --driver option. The supported drivers are devicemapper , overlay , and overlay2 . atomic storage reset This command deletes all containers and images from your system and resets the storage settings to their default values. 3.16. atomic scan Scans images and containers for Common Vulnerabilities and Exposures (CVEs). By default, atomic scan uses the openscap scanner to scan the images, but the pluggable design supports adding more scanners, including custom ones. When you run atomic scan the first time, it downloads the rhel7/openscap container which provides the openscap scanner. The default scan type for openscap is to check for vulnerabilities. Note that openscap works with RHEL-based images and containers only. Note To properly use the openscap container, run atomic install rhel7/openscap before using that container with atomic scan . See the atomic scan issue in the Known Issues section of the Atomic Release Notes for further details. For example, to scan the rhel7 base image, run: To scan all containers and images and produce a detailed report, run: If the results are positive, the output is similar to the following: To list all configured scanners, use: The output also lets you check what scan types are available for each scanner. openscap has two defined, and you can use the --scan_type option to swich between both: Adding a new scanner means simply installing a new image that provides that scanner with atomic install , and if it is a custom one that you have locally, use: You can use the new scanner with the --scanner option: To change the default scanner, edit the default_scanner line in /etc/atomic.conf . You can also use this line to explicitly set openscap as the default. If it is not set explicitly, atomic scan uses openscap . Another feature of atomic scan is that it can also scan the host file system. This can be configured using the --rootfs option and providing a path on the host, for example: 3.17. atomic sign Creates a local signature for one or more local images that have been pulled from a registry. By default, the signature is written into a directory derived from the registry configuration files as configured in the /etc/atomic.conf file using the registry_confdir keyword. Warning Only use atomic sign if you trust the remote registry which contains the image. It is recommended that this is a registry which you administer. Use the -d option to save the signature in a different than the default location: Use the --sign-by option to the default identity specified in the /etc/atomic.conf file and use --gnupghome to provide a location to that identity's keyring. For detailed information about image signing, see Signing Container Images chapter from the Red Hat Enterprise Linux Atomic Host Managing Containers Guide. 3.18. atomic verify The atomic verify command has been moved under the atomic images set of commands. See Section 3.7, "atomic images" for the description of atomic images verify . 3.19. atomic trust The atomic trust command manages the trust policy of the host system. The trust policy is stored in the /etc/containers/policy.json file and defines a scope of registries or repositories or both that must be signed by public keys. Trust is enforced when a user attempts to pull an image from a registry. atomic trust show Displays the contents of the /etc/containers/policy.json file: atomic trust default Manages the default trust policy. Use the accept or reject commands to enable or disable the default trust policy. or atomic trust add Updates the trust policy. To add a public key, use: To accept all unsigned images from a registry: atomic trust delete Removes a trust scope. For example: For detailed information about image signing, see Signing Container Images chapter from the Red Hat Enterprise Linux Atomic Host Managing Containers Guide. 3.20. atomic update Pulls the latest update of an image from the configured repositories. If a container based on this image exists, the container will continue to use the old image. Use the --force option to remove the container. An example output: 3.21. atomic --help and manual pages The --help option is available to atomic and all of the atomic subcommands described in this document. Use --help to print a usage message and all of the available options to a subcommand. As RHEL Atomic Host does not have man pages on the OSTree, you can access the manual pages for atomic and rpm-ostree through the Red Hat Enterprise Atomic Tools container. Use the following commands: Individual commands are hyphenated, so use the following format: You can access the rpm-ostree manual pages using the same commands.

Commands:
atomic host status State: idle Deployments: * rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard Version: 7.3 (2016-09-27 17:53:07) BaseCommit: d3fa3283db8c5ee656f78dcfc0fcffe6cd5aa06596dac6ec5e436352208a59cb Commit: f5e639ce8186386d74e2558e6a34f55a427d8f59412d47a907793e046875d8dd OSName: rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7.2/x86_64/autobrew/buildmaster Version: 7.2.7 (2016-09-15 22:28:54) BaseCommit: dbbc8e805f0003d8e55658dc220f1fe1397caf80221cc050eeb1bbf44bef56a1 Commit: 5cd426fa86bd1652ecd8f7d489f89f13ecb7d36e66003b0d7669721cb79545a8 OSName: rhel-atomic-host
atomic host rollback -r
atomic host deploy <version/commit ID>
atomic host deploy 7.2.1 -r
atomic host deploy 7.2.1 --preview
ostree pull --commit-metadata-only --depth -1 rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard ostree log rhel-host/7/x86_64/standard
atomic diff <image1> <image2>
atomic diff --rpms --no-files rhel7 centos rhel7 | centos --------------------------------- | --------------------------------- Red Hat Enterprise Linux Server | CentOS Linux release 7.2.1511 ( release 7.2 (Maipo) | Core) --------------------------------- | --------------------------------- | bind-license-32-9.9.4 | centos-release-0-7 dmidecode-1-2.12 | gdb-gdbserver-0-7.6.1 | | hostname-0-3.13 | iputils-0-20121221 libnl-0-1.1.4 | libxml2-python-0-2.9.1 | m2crypto-0-0.21.1 | python-dateutil-0-1.5 | python-dmidecode-0-3.10.13 | python-ethtool-0-0.8 | python-rhsm-0-1.15.4 | redhat-release-server-0-7.2 | subscription-manager-0-1.15.9 | | tar-2-1.26 usermode-0-1.111 | virt-what-0-1.13 | | yum-plugin-fastestmirror-0-1.1.31
atomic diff rhel7 centos | less
atomic diff --rpms --json rhel7 centos | less
atomic install <image>
atomic images info rhel7/rsyslog [output truncated] INSTALL: docker run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=IMAGE -e NAME=NAME IMAGE /bin/install.sh
atomic install rhel7/rsyslog docker run --rm --privileged -v /:/host -e HOST=/host -e IMAGE=rhel7/rsyslog -e NAME=rsyslog rhel7/rsyslog /bin/install.sh
atomic install -n name1 rhel7/rsyslog atomic install -n name2 rhel7/rsyslog
atomic uninstall <image>
atomic run <image>
docker run -d -n --cap_add SYS_TIME ntpd
docker create -ti -n <image_name> <container_name>
atomic stop <image_name>/<container_name>
atomic stop cranky_wright
atomic stop rhel7/rsyslog
atomic images list REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE registry.access.redhat.com/rhel7/openscap latest sha256:da0d5 2016-06-20 14:24 363.37 MB > registry.access.redhat.com/rhel7/sadc latest sha256:7ed99 2016-05-08 16:31 215.23 MB > registry.access.redhat.com/rhel7/kubernetes-controller-mgr latest sha256:feb3d 2016-05-06 20:12 347.29 MB > registry.access.redhat.com/rhel7/kubernetes-apiserver latest sha256:c3ac0 2016-05-06 20:12 347.29 MB registry.access.redhat.com/rhel7/kubernetes-scheduler latest sha256:d6c72 2016-05-06 20:12 347.29 MB > registry.access.redhat.com/rhel7/cockpit-ws latest sha256:f1ea2 2016-05-06 18:54 220.3 MB registry.access.redhat.com/rhel7/rhel-tools latest sha256:00211 2016-05-06 17:49 1.27 GB > registry.access.redhat.com/rhel7/rsyslog latest sha256:92bd7 2016-05-06 17:40 215.93 MB
atomic images delete <image>
atomic images delete -f rhel7/rsyslog
atomic images info <image>
atomic images info rhel7/rhel-tools Image Name: registry.access.redhat.com/rhel7/rhel-tools:latest License: GPLv3 architecture: x86_64 authoritative-source-url: registry.access.redhat.com build-date: 2017-06-23T11:07:50.586605 com.redhat.build-host: ip-10-29-120-119.ec2.internal com.redhat.component: rhel-tools-docker description: The Red Hat Enterprise Linux Atomic Tools Container (RHEL Tools Container) is a docker-formatted image that includes hundreds of software tools for troubleshooting and investigating a Red Hat Enterprise Linux Atomic (RHEL Atomic) Host. Designed to run as a privileged container, the RHEL Tools Container allows you to interact directly with the RHEL Atomic Host system to uncover and solve problems. Inside the RHEL Tools Container are popular tools such as sosreport, kdump, and many others (most of which are not included with RHEL Atomic). distribution-scope: public io.k8s.display-name: Red Hat Enterprise Linux Tools io.openshift.tags: base rhel7 name: rhel7/rhel-tools release: 29 run: docker run -it --name NAME --privileged --ipc=host --net=host --pid=host -e HOST=/host -e NAME=NAME -e IMAGE=IMAGE -v /run:/run -v /var/log:/var/log -v /etc/machine-id:/etc/machine-id -v /etc/localtime:/etc/localtime -v /:/host IMAGE summary: Provides the latest release of Red Hat Enterprise Linux 7 in a fully featured and supported base image. vcs-ref: c046119740d92e03ba17e27e806e46865fe85838 vcs-type: git vendor: Red Hat, Inc. version: 7.3
atomic images info --remote rhel7/rhel-tools
atomic images info --storage ostree rhel7/rhel-tools
atomic images list -a REPOSITORY TAG IMAGE ID CREATED VIRTUAL SIZE registry.access.redhat.com/rhel7/openscap latest sha256:da0d5 2016-06-20 14:24 363.37 MB > registry.access.redhat.com/rhel7/sadc latest sha256:7ed99 2016-05-08 16:31 215.23 MB > registry.access.redhat.com/rhel7/kubernetes-controller-mgr latest sha256:feb3d 2016-05-06 20:12 347.29 MB > registry.access.redhat.com/rhel7/kubernetes-apiserver latest sha256:c3ac0 2016-05-06 20:12 347.29 MB registry.access.redhat.com/rhel7/kubernetes-scheduler latest sha256:d6c72 2016-05-06 20:12 347.29 MB *<none> <none> sha256:bad41 2016-05-06 17:55 125.08 MB *<none> <none> sha256:9339b 2016-05-06 23:55 125.08 MB > registry.access.redhat.com/rhel7/cockpit-ws latest sha256:f1ea2 2016-05-06 18:54 220.3 MB registry.access.redhat.com/rhel7/rhel-tools latest sha256:00211 2016-05-06 17:49 1.27 GB > registry.access.redhat.com/rhel7/rsyslog latest sha256:92bd7 2016-05-06 17:40 215.93 MB
atomic images verify <image>
atomic images verify -v rhel7/rhel-tools rhel7/rhel-tools contains the following images: NAME LOCAL VERSION REMOTE VERSION DIFFERS rhel7/rhel-tools 7.3-29 7.3-29 NO
atomic images verify --storage ostree rhel7/rhel-tools
atomic images verify --no-validate --storage ostree registry.access.redhat.com/rhel7/etcd
atomic images version <image>
atomic version rhel7/rsyslog 00b31ffda5e92737fe07aecaa972d6fb4bda7cc8eca225f6a12e06db1ac5ba39 rhel7/rsyslog-7.1-29 registry.access.redhat.com/rhel7/rsyslog:latest
atomic containers list CONTAINER ID IMAGE COMMAND CREATED STATUS RUNTIME flannel rhel7/flannel /usr/bin/flanneld-ru 2016-10-06 14:36 running runc etcd rhel7/etcd /usr/bin/etcd-env.sh 2016-10-13 14:21 running runc 1cf730472572 rhel7/cockpit-ws /container/atomic-ru 2016-10-13 17:55 running Docker
atomic containers list -a CONTAINER ID IMAGE COMMAND CREATED STATUS RUNTIME etcd rhel7/etcd /usr/bin/etcd-env.sh 2016-10-13 14:21 running runc flannel rhel7/flannel /usr/bin/flanneld-ru 2016-10-13 15:12 failed runc 1cf730472572 rhel7/cockpit-ws /container/atomic-ru 2016-10-13 17:55 exited Docker 9a2bb24e5978 rhel7/rsyslog /bin/rsyslog.sh 2016-10-13 17:49 created Docker 34f95af8f8f9 rhel7/cockpit-ws /container/atomic-ru 2016-09-27 19:10 exited Docker
atomic containers list -f status=exited 1cf730472572 rhel7/cockpit-ws /container/atomic-ru 2016-10-13 17:55 exited Docker 34f95af8f8f9 rhel7/cockpit-ws /container/atomic-ru 2016-09-27 19:10 exited Docker
atomic containers update rhel7/flannel
atomic containers delete rhel7/flannel
atomic top [<container>]
ATOMIC TOP CONTA(I)NER* (N)AME (P)ID (C)PU (M)EM (U)ID (G)ID CMD ec56d2f1fb10 httpd 2087 0.0 0.2 0 0 httpd -DFOREGROUND ec56d2f1fb10 httpd 2095 0.0 0.1 1 1 httpd -DFOREGROUND ec56d2f1fb10 httpd 2096 0.0 0.1 1 1 httpd -DFOREGROUND ec56d2f1fb10 httpd 2097 0.0 0.1 1 1 httpd -DFOREGROUND fa7586391e42 fedora 1913 0.0 0.1 0 0 /bin/sh
atomic top -d 5 -n 3
atomic top --optional ppid uid
atomic mount <image> <mountpoint>
mkdir /root/tmp atomic mount rhel7/rsyslog /root/tmp cd /root/tmp ls
atomic unmount <mountpoint>
atomic unmount /root/tmp
atomic pull <image>
atomic pull rhel7/rsyslog
atomic pull oci:rhel7/etcd
atomic pull --storage=ostree docker:fedora
atomic pull --storage=ostree dockertar:path/to/image.tar
atomic pull --storage=ostree ostree:<remote>/branch
atomic pull --storage=ostree rhel7/etcd
atomic pull --type atomic <atomic_registry_address>:namespace/image
atomic push <new_image>
atomic storage export
atomic storage import
atomic storage modify --add-device vda3/rhelah-expand
atomic storage modify --driver overlay2
atomic scan <image>/<container>
atomic scan rhel7/rhel
atomic scan --all --verbose
atomic scan rhel7/rhel docker run -it --rm -v /etc/localtime:/etc/localtime -v /run/atomic/2016-06-21-10-10-28-942890:/scanin -v /var/lib/atomic/openscap/2016-06-21-10-10-28-942890:/scanout:rw,Z -v /etc/oscapd:/etc/oscapd:ro rhel7/openscap oscapd-evaluate scan --no-standard-compliance --targets chroots-in-dir:///scanin --output /scanout rhel7/rhel (sha256:bf203442) The following issues were found: RHSA-2016:1025: pcre security update (Important) Severity: Important RHSA URL: https://rhn.redhat.com/errata/RHSA-2016-1025.html RHSA ID: RHSA-2016:1025-00 Associated CVEs: CVE ID: CVE-2015-2328 CVE URL: https://access.redhat.com/security/cve/CVE-2015-2328 CVE ID: CVE-2015-3217 CVE URL: https://access.redhat.com/security/cve/CVE-2015-3217 CVE ID: CVE-2015-5073 CVE URL: https://access.redhat.com/security/cve/CVE-2015-5073 CVE ID: CVE-2015-8385 CVE URL: https://access.redhat.com/security/cve/CVE-2015-8385 CVE ID: CVE-2015-8386 CVE URL: https://access.redhat.com/security/cve/CVE-2015-8386 CVE ID: CVE-2015-8388 CVE URL: https://access.redhat.com/security/cve/CVE-2015-8388 CVE ID: CVE-2015-8391 CVE URL: https://access.redhat.com/security/cve/CVE-2015-8391 CVE ID: CVE-2016-3191 CVE URL: https://access.redhat.com/security/cve/CVE-2016-3191 Files associated with this scan are in /var/lib/atomic/openscap/2016-06-21-10-10-28-942890.
atomic scan --list Scanner: openscap * Image Name: rhel7/openscap Scan type: cve * Description: Performs a CVE scan based on known CVE data Scan type: standards_compliance Description: Performs a standards scan * denotes defaults
atomic scan --scan_type standards_compliance rhel7/rhel docker run -it --rm -v /etc/localtime:/etc/localtime -v /run/atomic/2016-07-12-16-08-03-011887:/scanin -v /var/lib/atomic/openscap/2016-07-12-16-08-03-011887:/scanout:rw,Z -v /etc/oscapd:/etc/oscapd:ro rhel7/openscap oscapd-evaluate scan --targets chroots-in-dir:///scanin --output /scanout --no-cve-scan rhel7 (sha256:5fbb7430) The following issues were found: Ensure Software Patches Installed Severity: Important XCCDF result: notchecked Files associated with this scan are in /var/lib/atomic/openscap/2016-07-12-16-08-03-011887.
atomic install localhost:5000/custom_scanner
atomic scan --scanner custom_scanner rhel7/rhel
default_scanner: custom_scanner
atomic scan --rootfs /tmp/chroot
atomic sign <registry>/<image>
atomic sign -d /tmp/signatures myregistry.exampe.com/my_image
atomic sign --sign-by user@example.com --gnupghome=~/.gnupg myregistry.example.com/my_image
atomic trust show * (default) accept
atomic trust default reject
atomic trust default accept
atomic trust add --pubkeys /etc/pki/containers/foo@example.com --sigstore https://server.example.com/foobar/sigstore/ <registry>/<image>
atomuc trust add --type insecureAcceptAnything <registry>
atomic trust delete <registry>
atomic update <image>
atomic update rhel7/rsyslog Using default tag: latest 00b31ffda5e9: Download complete c4f590bbcbe3: Download complete Status: Image is up to date for registry.access.redhat.com/rhel7/rsyslog:latest
atomic install rhel7/rhel-tools atomic run rhel7/rhel-tools man atomic
atomic run rhel7/rhel-tools man atomic-mount