podman-pull

Pull a specific container image

$ podman pull [image]:[tag]

$ podman pull [[-q|--quiet]] [image]:[tag]

$ podman pull [[-a|--all-tags]] [image]

$ podman pull --platform [linux/arm64] [image]:[tag]

$ podman pull --tls-verify=false [image]:[tag]

$ podman pull [[-h|--help]]

podman pull [OPTIONS] IMAGE [IMAGE...]

where IMAGE = [REGISTRY/]REPOSITORY[:TAG|@DIGEST]

--all-tags, -a
    Pull all tags in the repository

--arch ARCH
    Override architecture (e.g., arm64)

--authfile PATH
    Custom authentication file path

--authfile-parent PATH
    Auth file for parent images

--cert-dir DIR
    Certificates directory (default: /etc/docker/certs.d)

--creds USER:PASS
    Registry credentials

--detach, -d
    Pull in background

--os OS
    Override OS (e.g., linux)

--platform PLATFORM
    Platform (e.g., linux/amd64)

--policy POLICY
    Policy: always|missing|never (default: missing)

--quiet, -q
    Suppress progress output

--registry REGISTRY
    Specific registry endpoint

--save PATH
    Save to tarball instead of storage

--tls-verify[=true|false]
    Verify TLS certs (default: true)

--variant VARIANT
    Architecture variant

The podman pull command downloads container images from remote registries to local storage. Podman is a daemonless, OCI-compliant tool for managing containers, pods, and images, designed as a secure, rootless alternative to Docker.

It fetches the specified image layers, verifies signatures if configured, and stores them in the user's or system's container storage (e.g., ~/.local/share/containers/storage). Supports public registries like Docker Hub, Quay.io, and private ones with authentication.

Key features include pulling multiple images simultaneously, background downloads, multi-platform support, and options for all tags or specific architectures. Images are stored as OCI bundles, ready for podman run, podman build, or export.

Progress is shown by default with download speeds and ETAs. Errors occur for network issues, invalid credentials, or insufficient space. Rootless operation limits storage to user quotas, enhancing security by avoiding privileged daemons.

Requires network access and sufficient disk space. Rootless mode limits storage to user quotas. Private repos need auth config. Large images may take time; no resume on interrupt.

podman pull alpine
Pull latest alpine

podman pull -a quay.io/podman/hello
Pull all tags

podman pull --creds user:pass myregistry/image
Pull private image

PODMAN_AUTH_FILE: Fallback authfile path
PODMAN_TLS_VERIFY: Disable TLS (false)
REGISTRY_AUTH_FILE: Global auth

Introduced in Podman 1.0 (2018) by Red Hat as part of libpod project. Evolved from atomic, now in containers/storage. Added multi-arch, sigstore verification in v3+ (2021). Daemonless design from inception.

podman-push(1), podman-images(1), podman-run(1), skopeo-copy(1), buildah-pull(1)