[{"data":1,"prerenderedAt":791},["ShallowReactive",2],{"docs-nav":3,"docs:\u002Fdocs\u002Freference\u002Fcapability-matrix":139},[4,7,10,13,16,19,22,25,28,31,34,37,40,43,46,49,52,55,58,61,64,67,70,73,76,79,82,85,88,91,94,97,100,103,106,109,112,115,118,121,124,127,130,133,136],{"path":5,"title":6},"\u002Fdocs\u002Faccess-gating","Protect a local route",{"path":8,"title":9},"\u002Fdocs\u002Farchitecture\u002Fsecurity-and-trust","Security and trust",{"path":11,"title":12},"\u002Fdocs\u002Fconcepts\u002Fbuilds-and-deployments","Build and deploy",{"path":14,"title":15},"\u002Fdocs\u002Fconcepts\u002Fconfiguration-ownership","Where configuration belongs",{"path":17,"title":18},"\u002Fdocs\u002Fconcepts\u002Fenvironments-and-secrets","Environment values and secrets",{"path":20,"title":21},"\u002Fdocs\u002Fconcepts\u002Fmental-model","How projects fit together",{"path":23,"title":24},"\u002Fdocs\u002Fconcepts\u002Fplans-and-apply","Plans and apply",{"path":26,"title":27},"\u002Fdocs\u002Fconcepts\u002Ftargets-and-runtimes","Choose a target and runtime",{"path":29,"title":30},"\u002Fdocs\u002Fcontribute\u002Freleases","Publish a release",{"path":32,"title":33},"\u002Fdocs\u002Fdevelopment-mounts","Development mounts",{"path":35,"title":36},"\u002Fdocs\u002Fgetting-started","Getting started",{"path":38,"title":39},"\u002Fdocs\u002Fhelp\u002Ffaq","FAQ",{"path":41,"title":42},"\u002Fdocs\u002Fhelp\u002Ftroubleshooting","Troubleshooting",{"path":44,"title":45},"\u002Fdocs\u002Fhow-to\u002Fdeploy-production","Prepare a deployment environment",{"path":47,"title":48},"\u002Fdocs\u002Fhow-to\u002Fswarm-cluster","Run on a multi-node Swarm",{"path":50,"title":51},"\u002Fdocs","mm documentation",{"path":53,"title":54},"\u002Fdocs\u002Fjobs-and-schedules","Jobs and schedules",{"path":56,"title":57},"\u002Fdocs\u002Flocal-dashboard","Local dashboard",{"path":59,"title":60},"\u002Fdocs\u002Flocal-https","Local HTTPS",{"path":62,"title":63},"\u002Fdocs\u002Flocal-services","Local services",{"path":65,"title":66},"\u002Fdocs\u002Fmcp","Let an AI agent work on your project",{"path":68,"title":69},"\u002Fdocs\u002Fmulti-project-hosts","Run multiple projects on one host",{"path":71,"title":72},"\u002Fdocs\u002Fonboarding","Set up a project",{"path":74,"title":75},"\u002Fdocs\u002Fopenbao","Use OpenBao",{"path":77,"title":78},"\u002Fdocs\u002Fproject\u002Fcontributing","Contributing",{"path":80,"title":81},"\u002Fdocs\u002Fproject\u002Flicense","License",{"path":83,"title":84},"\u002Fdocs\u002Fproject\u002Fsecurity","Security",{"path":86,"title":87},"\u002Fdocs\u002Freference\u002Fcapability-matrix","Supported features and platforms",{"path":89,"title":90},"\u002Fdocs\u002Freference\u002Fcli","CLI command reference",{"path":92,"title":93},"\u002Fdocs\u002Freference\u002Fconfiguration","Configuration",{"path":95,"title":96},"\u002Fdocs\u002Freference\u002Fenvironment-variables","Environment variables",{"path":98,"title":99},"\u002Fdocs\u002Freference\u002Ferrors-and-exit-codes","Errors and exit codes",{"path":101,"title":102},"\u002Fdocs\u002Freference\u002Fknown-issues","Known limitations",{"path":104,"title":105},"\u002Fdocs\u002Fremote-access","Manage remote access",{"path":107,"title":108},"\u002Fdocs\u002Fremote-daemon","Set up a remote host",{"path":110,"title":111},"\u002Fdocs\u002Fruntime-observability","Status, logs, and commands",{"path":113,"title":114},"\u002Fdocs\u002Fsecret-delivery","Pass secrets to your app",{"path":116,"title":117},"\u002Fdocs\u002Fsecret-providers","Choose a secret store",{"path":119,"title":120},"\u002Fdocs\u002Fstart\u002Finstall","Install mm",{"path":122,"title":123},"\u002Fdocs\u002Fterminal-ui","Terminal UI",{"path":125,"title":126},"\u002Fdocs\u002Ftutorials\u002Fdotnet-web-api",".NET web API example",{"path":128,"title":129},"\u002Fdocs\u002Ftutorials\u002Ffirst-local-app","First local app",{"path":131,"title":132},"\u002Fdocs\u002Ftutorials\u002Flaravel-rust","Laravel and Rust example",{"path":134,"title":135},"\u002Fdocs\u002Ftutorials\u002Fnode-fullstack","Node full stack example",{"path":137,"title":138},"\u002Fdocs\u002Fvault","Use HashiCorp Vault",{"id":140,"title":87,"body":141,"description":784,"extension":785,"meta":786,"navigation":787,"path":86,"seo":788,"stem":789,"__hash__":790},"docs\u002Fdocs\u002Freference\u002Fcapability-matrix.md",{"type":142,"value":143,"toc":774},"minimark",[144,148,153,336,350,354,423,426,430,438,515,522,526,529,619,626,630,725,732,739,746,749,752,759,767],[145,146,147],"p",{},"Use Docker Compose or Podman Compose for the full local-development workflow.\nDocker Swarm runs on one or many nodes, without development mounts or jobs.",[149,150,152],"h2",{"id":151},"container-runtimes","Container runtimes",[154,155,156,175],"table",{},[157,158,159],"thead",{},[160,161,162,166,169,172],"tr",{},[163,164,165],"th",{},"Capability",[163,167,168],{},"Podman Compose",[163,170,171],{},"Docker Compose",[163,173,174],{},"Docker Swarm",[176,177,178,192,203,215,227,239,250,261,272,284,296,313,325],"tbody",{},[160,179,180,184,187,189],{},[181,182,183],"td",{},"Deploy services",[181,185,186],{},"yes",[181,188,186],{},[181,190,191],{},"Swarm stack",[160,193,194,197,199,201],{},[181,195,196],{},"Service status",[181,198,186],{},[181,200,186],{},[181,202,186],{},[160,204,205,208,210,212],{},[181,206,207],{},"Container health",[181,209,186],{},[181,211,186],{},[181,213,214],{},"not advertised",[160,216,217,220,222,224],{},[181,218,219],{},"Managed networks and volumes",[181,221,186],{},[181,223,186],{},[181,225,226],{},"yes; shared volumes via NFS",[160,228,229,232,234,236],{},[181,230,231],{},"Update files in managed volumes",[181,233,186],{},[181,235,186],{},[181,237,238],{},"unsupported",[160,240,241,244,246,248],{},[181,242,243],{},"Direct environment interpolation",[181,245,186],{},[181,247,186],{},[181,249,186],{},[160,251,252,255,257,259],{},[181,253,254],{},"Local bind mounts",[181,256,186],{},[181,258,186],{},[181,260,238],{},[160,262,263,266,268,270],{},[181,264,265],{},"Runtime secret delivery",[181,267,186],{},[181,269,186],{},[181,271,186],{},[160,273,274,277,279,281],{},[181,275,276],{},"Follow logs",[181,278,186],{},[181,280,186],{},[181,282,283],{},"yes, service\u002Ftask stream",[160,285,286,289,291,293],{},[181,287,288],{},"Execute a command",[181,290,186],{},[181,292,186],{},[181,294,295],{},"yes, tasks on the local node",[160,297,298,301,304,306],{},[181,299,300],{},"Service placement",[181,302,303],{},"ignored",[181,305,303],{},[181,307,308,309],{},"yes, ",[310,311,312],"code",{},"placement",[160,314,315,318,320,322],{},[181,316,317],{},"HTTPS routes with ACME",[181,319,186],{},[181,321,186],{},[181,323,324],{},"yes, on every ingress node",[160,326,327,330,332,334],{},[181,328,329],{},"One-shot jobs",[181,331,186],{},[181,333,186],{},[181,335,238],{},[145,337,338,339,344,345,349],{},"Deployment attempts to restore the last successful deployment if apply fails.\nSee ",[340,341,343],"a",{"href":342},"..\u002Fconcepts\u002Fbuilds-and-deployments","build and deploy"," for recovery limits.\nSSH access is handled by the ",[340,346,348],{"href":347},"..\u002Fremote-daemon","remote daemon",", not by a\ndirect connection to a remote container engine.",[149,351,353],{"id":352},"local-platform-support","Local platform support",[154,355,356,369],{},[157,357,358],{},[160,359,360,363,366],{},[163,361,362],{},"Platform",[163,364,365],{},"Trust scope",[163,367,368],{},"Verification",[176,370,371,385,397,408],{},[160,372,373,376,382],{},[181,374,375],{},"Debian\u002FUbuntu",[181,377,378,379],{},"system, ",[310,380,381],{},"sudo",[181,383,384],{},"CA bundle fingerprint and live CI handshake",[160,386,387,390,394],{},[181,388,389],{},"Fedora\u002FRHEL",[181,391,378,392],{},[310,393,381],{},[181,395,396],{},"extracted CA bundle fingerprint; no dedicated live runner",[160,398,399,402,405],{},[181,400,401],{},"macOS",[181,403,404],{},"login keychain by default",[181,406,407],{},"keychain fingerprint and live CI handshake",[160,409,410,413,416],{},[181,411,412],{},"Windows",[181,414,415],{},"Current User Root by default",[181,417,418,419,422],{},"typed ",[310,420,421],{},"X509Store"," query and live CI handshake",[145,424,425],{},"Unknown Linux trust layouts and unsupported operating systems fail closed.\nPrivate Unix-style file permission enforcement is not implemented on non-Unix\nplatforms, so operations requiring that guarantee are rejected there.",[149,427,429],{"id":428},"release-build-targets","Release build targets",[145,431,432,433,437],{},"The release workflow builds the targets below. This lists build support, not\ndownload availability; see ",[340,434,436],{"href":435},"..\u002Fstart\u002Finstall","installation"," for the current\ninstallation path.",[154,439,440,456],{},[157,441,442],{},[160,443,444,447,450,453],{},[163,445,446],{},"Operating system",[163,448,449],{},"x86-64",[163,451,452],{},"ARM64",[163,454,455],{},"Native package",[176,457,458,478,496],{},[160,459,460,463,468,473],{},[181,461,462],{},"Linux glibc",[181,464,465],{},[310,466,467],{},"x86_64-unknown-linux-gnu",[181,469,470],{},[310,471,472],{},"aarch64-unknown-linux-gnu",[181,474,475],{},[310,476,477],{},".tar.gz",[160,479,480,482,487,492],{},[181,481,401],{},[181,483,484],{},[310,485,486],{},"x86_64-apple-darwin",[181,488,489],{},[310,490,491],{},"aarch64-apple-darwin",[181,493,494],{},[310,495,477],{},[160,497,498,500,505,510],{},[181,499,412],{},[181,501,502],{},[310,503,504],{},"x86_64-pc-windows-msvc",[181,506,507],{},[310,508,509],{},"aarch64-pc-windows-msvc",[181,511,512],{},[310,513,514],{},".zip",[145,516,517,518,521],{},"The release packages listed here use glibc on Linux. The checkout's local\n",[310,519,520],{},".\u002Finstall.sh"," instead builds a musl Linux binary or a native macOS binary on\nx86-64 and ARM64. It does not support native Windows. Release installers require\na package matching the exact operating system and architecture.",[149,523,525],{"id":524},"secret-storage","Secret storage",[145,527,528],{},"Authentication is private state or process input, never public project\nconfiguration.",[154,530,531,550],{},[157,532,533],{},[160,534,535,538,541,544,547],{},[163,536,537],{},"Provider",[163,539,540],{},"Operations",[163,542,543],{},"Revisions",[163,545,546],{},"Rotation",[163,548,549],{},"Authentication",[176,551,552,571,590,606],{},[160,553,554,559,562,565,568],{},[181,555,556],{},[310,557,558],{},"age",[181,560,561],{},"inspect, resolve, create, replace, batch replace, stage, promote, delete",[181,563,564],{},"compare-and-swap",[181,566,567],{},"staged",[181,569,570],{},"local X25519 identity",[160,572,573,578,581,584,587],{},[181,574,575],{},[310,576,577],{},"env",[181,579,580],{},"inspect, resolve",[181,582,583],{},"observed process value",[181,585,586],{},"none",[181,588,589],{},"named process variable",[160,591,592,595,598,600,603],{},[181,593,594],{},"OpenBao provider instance",[181,596,597],{},"inspect, resolve, create, replace, delete",[181,599,564],{},[181,601,602],{},"replace",[181,604,605],{},"private AppRole credential",[160,607,608,611,613,615,617],{},[181,609,610],{},"Vault provider instance",[181,612,597],{},[181,614,564],{},[181,616,602],{},[181,618,605],{},[145,620,621,622,625],{},"Age and environment storage accept text up to 1 MiB. OpenBao and Vault accept\nsafe text up to 512 KiB. Locations are bounded to 1,024 bytes where applicable;\nenvironment locations must be valid variable names. ",[310,623,624],{},"mm secret provider list --output json"," returns driver and configured-instance descriptors without\nrevealing provider credentials.",[149,627,629],{"id":628},"secret-delivery","Secret delivery",[154,631,632,648],{},[157,633,634],{},[160,635,636,639,642,645],{},[163,637,638],{},"Driver",[163,640,641],{},"Runtime",[163,643,644],{},"Delivery",[163,646,647],{},"mm plaintext lifetime",[176,649,650,666,680,695,710],{},[160,651,652,657,660,663],{},[181,653,654],{},[310,655,656],{},"direct-environment",[181,658,659],{},"all three",[181,661,662],{},"service environment",[181,664,665],{},"no mm file; engines may retain metadata",[160,667,668,673,675,677],{},[181,669,670],{},[310,671,672],{},"operation-env-file",[181,674,659],{},[181,676,662],{},[181,678,679],{},"owner-only operation file",[160,681,682,687,689,692],{},[181,683,684],{},[310,685,686],{},"podman-native-secret",[181,688,168],{},[181,690,691],{},"native mounted secret",[181,693,694],{},"Podman-managed store",[160,696,697,702,704,707],{},[181,698,699],{},[310,700,701],{},"swarm-native-secret",[181,703,174],{},[181,705,706],{},"immutable mounted secret",[181,708,709],{},"Swarm-managed store (all nodes)",[160,711,712,717,720,723],{},[181,713,714],{},[310,715,716],{},"compose-file-secret",[181,718,719],{},"Docker Compose outside Swarm",[181,721,722],{},"Compose file source",[181,724,679],{},[145,726,727,728,731],{},"Environment drivers accept text up to 1 MiB and names up to 255 bytes. Runtime\nsecret drivers use a conservative 500 KiB limit and accept text or binary.\nPodman and Swarm support numeric UID, GID, and mode. Compose file secrets support\nonly UID 0, GID 0, mode ",[310,729,730],{},"0444","; other requests fail before a file is written.",[145,733,734,735,738],{},"Compose has no native persistent secret store. mm creates a private ",[310,736,737],{},"0600","\noperation file and removes its path after Compose runs; the mounted inode remains\navailable to the created container, but recreation requires another operation.\nRotation is rejected if rollback material cannot be reconstructed.",[145,740,741,742,745],{},"One-shots reuse a configured Compose service contract, including its selected\nenvironment and runtime secret mounts. Swarm one-shots fail capability preflight\nbecause the CLI adapter cannot safely clone that complete contract without\nplacing environment values in process arguments. BuildKit secret inputs are a separate,\nsupported build path: ",[310,743,744],{},"build.secrets"," values are resolved only after review and\npassed through private operation files. Compatibility planning rejects\nunsupported runtime, workload, material, size, permission, and rollback\ncombinations before mutation.",[149,747,63],{"id":748},"local-services",[145,750,751],{},"The shared ingress, dashboard, Mailpit, and optional access-gate components are\ninstallation-wide local services. They require a configured local target,\nHAProxy, and either a Linux systemd host with a local Podman Compose or Docker\nCompose engine, or macOS with Docker Desktop and Docker Compose. They are not\nimplemented on Windows or with other macOS container engines, and are not\nremote-host or multi-node service orchestration. Host publication is\nloopback-only where offered. Components use pinned images and ownership checks,\nand optional services are installed only through a reviewed plan.",[145,753,754,755,758],{},"Managed OpenBao and Vault support local Docker Compose and rootless Podman\nCompose. They do not support managed lifecycle operations on Swarm or remote\ntargets. Rootless Podman requires a working user namespace and ",[310,756,757],{},"podman unshare",".",[145,760,761,762,766],{},"For automation, ",[340,763,765],{"href":764},"\u002Fschema\u002Fcapabilities.json","capabilities JSON"," provides the\ngenerated runtime and secret-provider definitions.",[145,768,769,770,773],{},"See ",[340,771,102],{"href":772},".\u002Fknown-issues"," for user-visible unsupported\ncombinations.",{"title":775,"searchDepth":776,"depth":776,"links":777},"",2,[778,779,780,781,782,783],{"id":151,"depth":776,"text":152},{"id":352,"depth":776,"text":353},{"id":428,"depth":776,"text":429},{"id":524,"depth":776,"text":525},{"id":628,"depth":776,"text":629},{"id":748,"depth":776,"text":63},"Compare container runtimes, operating systems, and secret stores.","md",{},true,{"title":87,"description":784},"docs\u002Freference\u002Fcapability-matrix","anGTSmtDzHRGdrLf5tGgyfgqF0bpOtVpJeQ9OiRCRl8",1794512545908]