Podman: Docker Alternative for Rootless Containers

Overview

Podman (Pod Manager) is a daemonless, rootless container engine developed by Red Hat that provides a Docker-compatible CLI while addressing fundamental security concerns in traditional container runtimes. Unlike Docker’s client-server architecture, Podman directly spawns containers as child processes, eliminating the need for a privileged daemon and enabling true rootless container execution.

For homelabbers who prioritize security, Podman offers a compelling alternative: containers run without root privileges by default, integrate natively with systemd for service management, and maintain compatibility with existing Docker workflows. You can use the same Dockerfiles, the same CLI commands, and even alias docker to podman for a seamless transition.

What you’ll learn:

Install and configure Podman on Linux systems
Run rootless containers for enhanced security
Use Podman Compose for multi-container applications
Migrate existing Docker setups to Podman
Integrate containers with systemd for automatic startup
Understand the architectural differences between Podman and Docker
Implement best practices for rootless container security
Troubleshoot common Podman issues

Why Podman?

Instead of running a privileged daemon that controls all containers (Docker’s approach), Podman lets you run containers directly as your user account, with no daemon required. Each container is an isolated process tree under your control, managed by systemd just like any other service. This architecture eliminates entire classes of security vulnerabilities while maintaining full Docker compatibility.

Prerequisites

Before starting, ensure you have:

Linux system (Ubuntu 20.04+, Fedora 31+, RHEL 8+, or compatible)
Basic Linux knowledge including command line and systemd
Understanding of containers and Docker concepts helpful
Hardware requirements:
- Minimum 1 GB RAM (2 GB recommended)
- 10 GB storage for images and containers
- x86_64 or ARM64 processor
User account with sudo privileges for initial setup
Familiarity with Docker (helpful but not required)

Note: Podman is primarily designed for Linux. While Podman Desktop exists for Windows/macOS, this guide focuses on Linux deployment where rootless benefits are most significant.

Understanding Podman Fundamentals

What Makes Podman Different?

Podman vs. Docker: Architectural Comparison

Aspect	Docker	Podman
Architecture	Client-server (daemon)	Daemonless (fork/exec)
Root Requirement	Daemon runs as root	Rootless by default
Process Model	All containers under one daemon	Each container as user process
Systemd Integration	Third-party solutions	Native support
Socket API	Docker socket	Compatible socket (optional)
CLI Compatibility	Standard	Docker-compatible
Pods Support	Via Compose/Swarm	Native Kubernetes-style pods
Image Format	OCI-compliant	OCI-compliant
Registry	Docker Hub default	Multiple registries

Key Concepts

1. Daemonless Architecture

Docker:
  ┌─────────┐         ┌──────────────┐
  │ docker  │────────>│ dockerd      │ (root)
  │ CLI     │         │ (daemon)     │
  └─────────┘         └──────┬───────┘
                             │
                    ┌────────┴────────┐
                    │   Containers    │
                    └─────────────────┘

Podman:
  ┌─────────┐         ┌─────────────┐
  │ podman  │────────>│ conmon      │ (user)
  │ CLI     │         │ (monitor)   │
  └─────────┘         └──────┬──────┘
                             │
                       ┌─────┴─────┐
                       │ Container │ (user process)
                       └───────────┘

Benefits:

No privileged daemon to exploit
Containers are child processes of your user session
System reboot doesn’t require daemon restart
Process isolation at the user level

2. Rootless Containers

Traditional Docker requires root privileges (or docker group membership) because the daemon runs as root. Podman containers run within your user namespace:

# Docker (requires root or docker group)
$ docker run nginx
# Process owned by root

# Podman (runs as your user)
$ podman run nginx
# Process owned by you (e.g., UID 1000)

Security benefits:

Container escape affects only your user account, not entire system
No need to add users to privileged groups
Attackers can’t escalate to root via daemon
Audit trail shows actual user, not just “docker group”

3. Pods (Kubernetes-compatible)

Podman supports Kubernetes-style pods - groups of containers that share network namespace:

# Create a pod (shared network)
podman pod create --name mypod -p 8080:80

# Add containers to pod
podman run -d --pod mypod nginx
podman run -d --pod mypod redis

# All containers share localhost network
# nginx can access redis at localhost:6379

4. Systemd Integration

Podman generates systemd unit files for containers:

# Generate user service
podman generate systemd --new --files --name mycontainer

# Enable auto-start
systemctl --user enable container-mycontainer.service

No need for third-party tools like docker-compose-systemd.

Installation and Setup

Ubuntu/Debian Installation

Ubuntu 20.10+:

# Update package list
sudo apt update

# Install Podman
sudo apt install -y podman

# Verify installation
podman --version

Ubuntu 20.04 (requires kubic repository):

# Add kubic repository
echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libpod:/stable/xUbuntu_20.04/ /" |   sudo tee /etc/apt/sources.list.d/devel:kubic:libpod:stable.list

# Add GPG key
curl -L "https://download.opensuse.org/repositories/devel:/kubic:/libpod:/stable/xUbuntu_20.04/Release.key" |   sudo apt-key add -

# Install
sudo apt update
sudo apt install -y podman

# Verify
podman --version

Fedora/RHEL/CentOS Installation

Fedora:

# Podman is pre-installed on Fedora 31+
podman --version

# If not installed:
sudo dnf install -y podman

# Install additional tools
sudo dnf install -y podman-compose podman-docker

RHEL 8+/CentOS Stream:

# Install Podman
sudo dnf install -y podman

# Install rootless support
sudo dnf install -y slirp4netns fuse-overlayfs

# Verify
podman --version

Post-Installation Configuration

Enable rootless containers:

# Check subuid/subgid ranges
cat /etc/subuid
cat /etc/subgid

# Should show your username with UID range
# youruser:100000:65536

# If missing, add (requires root):
sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER

# Reboot or restart user session

Configure registries:

Edit ~/.config/containers/registries.conf:

unqualified-search-registries = ["docker.io", "quay.io"]

[[registry]]
location = "docker.io"

[[registry]]
location = "quay.io"

Set storage driver (optional):

Edit ~/.config/containers/storage.conf:

[storage]
driver = "overlay"
runroot = "/run/user/1000/containers"
graphroot = "/home/youruser/.local/share/containers/storage"

[storage.options]
mount_program = "/usr/bin/fuse-overlayfs"

Verify rootless setup:

# Run test container
podman run --rm alpine cat /proc/self/uid_map

# Output should show UID mapping:
#          0       1000          1
#          1     100000      65536

This confirms rootless user namespace mapping is working.

Docker to Podman Migration

Command Compatibility

Podman is designed as a drop-in Docker replacement. Most commands are identical:

Direct equivalents:

# Docker                    →  Podman
docker run                  →  podman run
docker ps                   →  podman ps
docker images               →  podman images
docker build                →  podman build
docker pull                 →  podman pull
docker push                 →  podman push
docker logs                 →  podman logs
docker exec                 →  podman exec
docker stop                 →  podman stop
docker rm                   →  podman rm
docker rmi                  →  podman rmi

Create an alias for seamless migration:

# Add to ~/.bashrc or ~/.zshrc
alias docker=podman

# Now 'docker' commands use Podman
docker run nginx
docker ps

Docker Compose to Podman Compose

Install podman-compose:

# Using pip
pip3 install podman-compose

# Or on Fedora
sudo dnf install podman-compose

# Verify
podman-compose --version

Using existing docker-compose.yml files:

# docker-compose.yml (works with both Docker and Podman)
version: '3.8'

services:
  web:
    image: nginx:alpine
    ports:
      - "8080:80"
    volumes:
      - ./html:/usr/share/nginx/html:ro

  db:
    image: postgres:15-alpine
    environment:
      POSTGRES_PASSWORD: example
    volumes:
      - db_data:/var/lib/postgresql/data

volumes:
  db_data:

Run with podman-compose:

# Same commands as docker-compose
podman-compose up -d
podman-compose ps
podman-compose logs -f
podman-compose down

Alternative: Docker Compose with Podman socket:

# Enable Podman socket (compatible with Docker API)
systemctl --user enable --now podman.socket

# Export Docker socket environment variable
export DOCKER_HOST=unix:///run/user/$UID/podman/podman.sock

# Now use docker-compose with Podman backend
docker-compose up -d

Migrating Existing Containers

Export from Docker, import to Podman:

# On Docker system: save running container
docker commit mycontainer mycontainer:migrate
docker save -o mycontainer.tar mycontainer:migrate

# Transfer tar file to Podman system

# On Podman system: import
podman load -i mycontainer.tar
podman run -d --name mycontainer mycontainer:migrate

Migrate volumes:

# Docker: export volume data
docker run --rm   -v myvolume:/source:ro   -v $(pwd):/backup   alpine tar czf /backup/myvolume.tar.gz /source

# Podman: create volume and import
podman volume create myvolume
podman run --rm   -v myvolume:/dest   -v $(pwd):/backup:ro   alpine tar xzf /backup/myvolume.tar.gz -C /dest --strip-components=1

Running Containers with Podman

Basic Container Operations

Run a simple container:

# Run nginx web server
podman run -d   --name webserver   -p 8080:80   nginx:alpine

# Verify it's running
podman ps

# Check logs
podman logs webserver

# Access shell
podman exec -it webserver sh

# Stop and remove
podman stop webserver
podman rm webserver

Rootless Networking

Podman rootless uses slirp4netns for network isolation:

Port mapping (requires root privileges or ports >1024):

# Rootless: Use ports >= 1024
podman run -d -p 8080:80 nginx

# Rootful (requires sudo): Use privileged ports
sudo podman run -d -p 80:80 nginx

Enable rootless privileged ports (under 1024):

# Allow your user to bind ports >= 80
sudo sysctl net.ipv4.ip_unprivileged_port_start=80

# Make persistent
echo 'net.ipv4.ip_unprivileged_port_start=80' |   sudo tee /etc/sysctl.d/99-podman-ports.conf

Network modes:

# Bridge network (default)
podman run --network bridge nginx

# Host network (shares host network stack)
podman run --network host nginx

# None (no network)
podman run --network none alpine

# Custom network
podman network create mynet
podman run --network mynet nginx

Volume Management

Named volumes:

# Create named volume
podman volume create mydata

# Use in container
podman run -d   -v mydata:/app/data   myapp:latest

# List volumes
podman volume ls

# Inspect volume
podman volume inspect mydata

# Remove volume
podman volume rm mydata

Bind mounts:

# Mount host directory (must be in your home directory for rootless)
podman run -d   -v ~/myapp/config:/etc/myapp:ro   -v ~/myapp/data:/var/lib/myapp:rw   myapp:latest

Rootless volume ownership:

Podman automatically maps UIDs in rootless mode:

# Create directory
mkdir -p ~/data
echo "test" > ~/data/file.txt

# Run container
podman run --rm -v ~/data:/data:ro alpine ls -la /data

# Output shows mapped ownership:
# -rw-r--r-- 1 root root ... file.txt
# (appears as root inside container, but owned by you on host)

Working with Pods

Understanding Pods

Pods are groups of containers that share:

Network namespace (all containers share localhost)
IPC namespace
Optional: UTS, PID namespaces

Use cases:

Web app + sidecar proxy (nginx + php-fpm)
Application + log aggregator
Microservices that need localhost communication
Kubernetes manifest compatibility

Creating and Managing Pods

Create a pod:

# Create pod with port mapping
podman pod create   --name wordpress   -p 8080:80

# Add containers to pod
podman run -d   --pod wordpress   --name wordpress-db   -e MYSQL_ROOT_PASSWORD=secret   -e MYSQL_DATABASE=wordpress   mysql:8.0

podman run -d   --pod wordpress   --name wordpress-app   -e WORDPRESS_DB_HOST=127.0.0.1   -e WORDPRESS_DB_USER=root   -e WORDPRESS_DB_PASSWORD=secret   -e WORDPRESS_DB_NAME=wordpress   wordpress:latest

# Containers in same pod use localhost to communicate
# wordpress-app connects to mysql at 127.0.0.1:3306

Pod management:

# List pods
podman pod ls

# Inspect pod
podman pod inspect wordpress

# Start/stop entire pod
podman pod start wordpress
podman pod stop wordpress

# Remove pod and all containers
podman pod rm -f wordpress

Generating Kubernetes YAML

Export pod as Kubernetes manifest:

# Generate Kubernetes YAML
podman generate kube wordpress > wordpress-pod.yaml

# Contents:
cat wordpress-pod.yaml

apiVersion: v1
kind: Pod
metadata:
  name: wordpress
spec:
  containers:
  - name: wordpress-db
    image: mysql:8.0
    env:
    - name: MYSQL_ROOT_PASSWORD
      value: secret
    - name: MYSQL_DATABASE
      value: wordpress
  - name: wordpress-app
    image: wordpress:latest
    env:
    - name: WORDPRESS_DB_HOST
      value: 127.0.0.1
    - name: WORDPRESS_DB_PASSWORD
      value: secret
    ports:
    - containerPort: 80
      hostPort: 8080

Deploy from Kubernetes YAML:

# Remove existing pod
podman pod rm -f wordpress

# Create from YAML
podman play kube wordpress-pod.yaml

# Update: stop, recreate
podman play kube --replace wordpress-pod.yaml

This enables easy migration to Kubernetes later!

Systemd Integration

Why Systemd Integration Matters

Benefits:

Auto-start containers on boot
Automatic restart on failure
Resource limits (CPU, memory, IO)
Logging via journald
Service dependencies (start db before app)
User-level services (no root required)

Generating Systemd Unit Files

For a single container:

# Run container
podman run -d   --name nginx   -p 8080:80   nginx:alpine

# Generate systemd unit file
podman generate systemd --new --files --name nginx

# Output: container-nginx.service

# Move to systemd user directory
mkdir -p ~/.config/systemd/user/
mv container-nginx.service ~/.config/systemd/user/

# Enable and start
systemctl --user daemon-reload
systemctl --user enable container-nginx.service
systemctl --user start container-nginx.service

# Check status
systemctl --user status container-nginx.service

For a pod:

# Create pod with containers
podman pod create --name mypod -p 8080:80
podman run -d --pod mypod nginx:alpine

# Generate unit files for entire pod
podman generate systemd --new --files --name mypod

# Outputs:
# - pod-mypod.service
# - container-mypod-nginx.service

# Install services
mv pod-mypod.service ~/.config/systemd/user/
mv container-*.service ~/.config/systemd/user/

systemctl --user daemon-reload
systemctl --user enable pod-mypod.service
systemctl --user start pod-mypod.service

Persistent User Services

Enable lingering (services survive logout):

# Enable linger for your user
sudo loginctl enable-linger $USER

# Verify
loginctl show-user $USER | grep Linger
# Linger=yes

# Now systemd user services run even when logged out

Manage services:

# Start service
systemctl --user start container-nginx.service

# Stop service
systemctl --user stop container-nginx.service

# Restart service
systemctl --user restart container-nginx.service

# View logs
journalctl --user -u container-nginx.service -f

# Disable auto-start
systemctl --user disable container-nginx.service

Real-World Example: Database Server

# Create PostgreSQL container
podman run -d   --name postgres   -e POSTGRES_PASSWORD=secret   -v postgres-data:/var/lib/postgresql/data:Z   -p 5432:5432   postgres:15-alpine

# Generate systemd service
podman generate systemd --new --name postgres > postgres.service

# Install service
mv postgres.service ~/.config/systemd/user/container-postgres.service

# Enable auto-start
systemctl --user daemon-reload
systemctl --user enable container-postgres.service

# Enable persistent services
sudo loginctl enable-linger $USER

# Verify auto-start
systemctl --user status container-postgres.service

Advanced Podman Features

Auto-Update Containers

Podman can automatically pull new images and recreate containers:

# Label container for auto-update
podman run -d   --name nginx   --label "io.containers.autoupdate=registry"   -p 8080:80   nginx:alpine

# Enable auto-update timer (checks daily)
systemctl --user enable --now podman-auto-update.timer

# Manual update check
podman auto-update

# View update logs
journalctl --user -u podman-auto-update.service

Rootless Port Forwarding

Using systemd socket activation:

Create ~/.config/systemd/user/podman-nginx.socket:

[Unit]
Description=Nginx Socket

[Socket]
ListenStream=8080

[Install]
WantedBy=sockets.target

Create ~/.config/systemd/user/podman-nginx.service:

[Unit]
Description=Nginx Container
Requires=podman-nginx.socket

[Service]
Type=notify
NotifyAccess=all
ExecStart=/usr/bin/podman run 
  --rm   --name nginx   --sdnotify=conmon 
  nginx:alpine

[Install]
WantedBy=multi-user.target

Enable:

systemctl --user daemon-reload
systemctl --user enable --now podman-nginx.socket

Building Images with Buildah

Buildah is Podman’s companion tool for building images:

# Install Buildah
sudo apt install buildah  # Ubuntu/Debian
sudo dnf install buildah  # Fedora

# Build from Dockerfile
buildah build -t myapp:latest .

# Or use podman build (wrapper around Buildah)
podman build -t myapp:latest .

# Rootless builds work out of the box

Example Dockerfile:

FROM alpine:latest

RUN apk add --no-cache nginx

COPY nginx.conf /etc/nginx/nginx.conf
COPY html /usr/share/nginx/html

EXPOSE 80

CMD ["nginx", "-g", "daemon off;"]

# Build
podman build -t mynginx:latest .

# Run
podman run -d -p 8080:80 mynginx:latest

Security Best Practices

Rootless is Default

Always prefer rootless Podman unless you specifically need root:

# Good: rootless (default)
podman run nginx

# Avoid unless necessary: rootful
sudo podman run nginx

SELinux Context Labels

On SELinux systems (RHEL, Fedora), label volumes correctly:

# :z - private volume (recommended)
podman run -v ~/data:/data:z nginx

# :Z - shared volume
podman run -v ~/data:/data:Z nginx

# Without label: permission denied errors

Read-Only Root Filesystem

# Run with read-only root
podman run --read-only --tmpfs /tmp nginx

# Application can only write to /tmp

Limit Resources

# CPU limit (50% of 1 CPU)
podman run --cpus=0.5 nginx

# Memory limit
podman run --memory=512m nginx

# Combined
podman run   --cpus=1.0   --memory=1g   --memory-swap=1g   nginx

Drop Capabilities

# Drop all capabilities except necessary ones
podman run   --cap-drop=all   --cap-add=net_bind_service   nginx

Use Non-Root Users in Containers

FROM node:18-alpine

# Create non-root user
RUN addgroup -g 1001 -S appuser && 
    adduser -u 1001 -S appuser -G appuser

USER appuser

CMD ["node", "server.js"]

Troubleshooting Common Issues

Issue: “Permission denied” on volumes

Symptom: Container can’t write to mounted directory

Solution:

# Check SELinux labels (RHEL/Fedora)
podman run -v ~/data:/data:z nginx

# Or disable SELinux temporarily (debugging only)
sudo setenforce 0

# Check ownership
ls -la ~/data
# Should be owned by your user

# Fix permissions
chmod 755 ~/data

Issue: Can’t bind to privileged ports (below 1024)

Symptom: Error: permission denied: cannot bind to privileged port

Solution:

# Option 1: Use port >= 1024
podman run -p 8080:80 nginx

# Option 2: Lower unprivileged port start
sudo sysctl net.ipv4.ip_unprivileged_port_start=80

# Option 3: Use rootful Podman
sudo podman run -p 80:80 nginx

Issue: “No space left on device”

Symptom: Can’t pull images or create containers

Solution:

# Check storage usage
podman system df

# Clean up unused images
podman image prune -a

# Remove stopped containers
podman container prune

# Remove unused volumes
podman volume prune

# Full cleanup
podman system prune -a --volumes

Issue: Slow container startup

Symptom: Containers take long to start in rootless mode

Solution:

# Use faster storage driver
# Edit ~/.config/containers/storage.conf
[storage]
driver = "overlay"

[storage.options]
mount_program = "/usr/bin/fuse-overlayfs"

# Reset storage (WARNING: deletes all images/containers)
podman system reset

Issue: Container networking issues

Symptom: Containers can’t reach internet or each other

Solution:

# Check slirp4netns is installed
which slirp4netns

# If missing:
sudo apt install slirp4netns  # Ubuntu
sudo dnf install slirp4netns  # Fedora

# Test network
podman run --rm alpine ping -c 3 google.com

# Check DNS
podman run --rm alpine nslookup google.com

# Use host network (debugging)
podman run --network host alpine ping google.com

Podman Compose Example: Complete Stack

Here’s a complete example deploying a monitoring stack:

docker-compose.yml:

version: '3.8'

services:
  prometheus:
    image: prom/prometheus:latest
    container_name: prometheus
    restart: unless-stopped
    ports:
      - "9090:9090"
    volumes:
      - ./prometheus.yml:/etc/prometheus/prometheus.yml:ro,z
      - prometheus_data:/prometheus:z
    command:
      - '--config.file=/etc/prometheus/prometheus.yml'
      - '--storage.tsdb.path=/prometheus'

  grafana:
    image: grafana/grafana:latest
    container_name: grafana
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      - GF_SECURITY_ADMIN_PASSWORD=admin
    volumes:
      - grafana_data:/var/lib/grafana:z
    depends_on:
      - prometheus

  node-exporter:
    image: prom/node-exporter:latest
    container_name: node-exporter
    restart: unless-stopped
    ports:
      - "9100:9100"
    command:
      - '--path.rootfs=/host'
    volumes:
      - /:/host:ro,rslave
    pid: host

volumes:
  prometheus_data:
  grafana_data:

Deploy:

# Create prometheus.yml
cat > prometheus.yml <<EOF
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'node-exporter'
    static_configs:
      - targets: ['node-exporter:9100']
EOF

# Start stack
podman-compose up -d

# Check status
podman-compose ps

# View logs
podman-compose logs -f

# Generate systemd services for auto-start
podman generate systemd --new --files --name prometheus
podman generate systemd --new --files --name grafana
podman generate systemd --new --files --name node-exporter

# Install services
mv container-*.service ~/.config/systemd/user/
systemctl --user daemon-reload
systemctl --user enable container-prometheus.service
systemctl --user enable container-grafana.service
systemctl --user enable container-node-exporter.service

Comparison with Docker

When to Choose Podman

Podman is ideal for:

Security-conscious homelabs (rootless by default)
Red Hat ecosystem (RHEL, Fedora, CentOS)
Systemd-based service management
Kubernetes migration path (pod support)
Multi-user systems (user-level isolation)
Air-gapped or restricted environments

When to Choose Docker

Docker is ideal for:

Maximum ecosystem compatibility
Extensive third-party integrations
Docker Swarm orchestration
Windows/macOS development (Docker Desktop)
Teams already using Docker
Need for GUI tools (Portainer, Dockge work better)

Can You Use Both?

Yes, but be careful about confusion:

# Run Docker daemon on port 2375
# Run Podman on default socket

# Use DOCKER_HOST to switch
export DOCKER_HOST=tcp://localhost:2375  # Docker
unset DOCKER_HOST                         # Podman

# Or use explicit commands
docker ps     # Docker
podman ps     # Podman

Conclusion and Next Steps

Podman offers a secure, daemonless alternative to Docker that’s particularly well-suited for homelabs where security and systemd integration matter. By running containers without root privileges and eliminating the daemon attack surface, Podman addresses fundamental security concerns while maintaining full Docker compatibility.

Key Takeaways

Rootless by default: Containers run as user processes, not root
Daemonless architecture: No privileged daemon to exploit
Docker-compatible: Same commands, same images, same workflows
Systemd integration: Native support for service management
Pod support: Kubernetes-style multi-container groups
Red Hat backing: Enterprise-grade development and support

When to Use Podman

Perfect for:

Security-focused homelab deployments
Red Hat ecosystem (RHEL, Fedora)
Rootless container requirements
Systemd service management
Kubernetes migration path

Consider Docker if:

You need Docker Swarm
Maximum third-party tool compatibility
Prefer GUI management (Portainer, Dockge)
Running on Windows/macOS (Docker Desktop)

Recommended Workflow

Start with rootless: Install and configure Podman rootless
Test compatibility: Run existing containers with podman run
Migrate compose stacks: Use podman-compose for multi-container apps
Enable systemd: Generate unit files for auto-start
Enable lingering: Services survive logout
Set up auto-updates: Keep containers current

Next Steps

Beginner:

Install Podman on Linux system
Run basic containers (nginx, alpine)
Create a simple pod
Generate systemd service

Intermediate:

Migrate Docker Compose stack
Set up rootless networking
Configure auto-updates
Implement volume management

Advanced:

Build custom images with Buildah
Generate Kubernetes YAML
Set up multi-user rootless environment
Integrate with monitoring (Prometheus)

Docker Basics - Foundation for container concepts
Dockge Guide - Compose stack management (Docker-focused)
K3s Guide - Lightweight Kubernetes (migration path)
Portainer Guide - GUI management (limited Podman support)

Resources

Official Documentation: https://docs.podman.io/
Red Hat Podman Guide: https://www.redhat.com/sysadmin/podman-guides
Podman Desktop: https://podman-desktop.io/
GitHub Repository: https://github.com/containers/podman
Buildah: https://buildah.io/
Community Forums: https://github.com/containers/podman/discussions

Document Version: 1.0 Last Updated: December 16, 2024 Based on: Podman 4.9+ Estimated Completion Time: 60 minutes (basic setup), 4-6 hours (full migration)

Happy rootless containerizing!

Overview

Prerequisites

Understanding Podman Fundamentals

What Makes Podman Different?

Key Concepts

Installation and Setup

Ubuntu/Debian Installation

Fedora/RHEL/CentOS Installation

Post-Installation Configuration

Docker to Podman Migration

Command Compatibility

Docker Compose to Podman Compose

Migrating Existing Containers

Running Containers with Podman

Basic Container Operations

Rootless Networking

Volume Management

Working with Pods

Understanding Pods

Creating and Managing Pods

Generating Kubernetes YAML

Systemd Integration

Why Systemd Integration Matters

Generating Systemd Unit Files

Persistent User Services

Real-World Example: Database Server

Advanced Podman Features

Auto-Update Containers

Rootless Port Forwarding

Building Images with Buildah

Security Best Practices

Rootless is Default

SELinux Context Labels

Read-Only Root Filesystem

Limit Resources

Drop Capabilities

Use Non-Root Users in Containers

Troubleshooting Common Issues

Issue: “Permission denied” on volumes

Issue: Can’t bind to privileged ports (below 1024)

Issue: “No space left on device”

Issue: Slow container startup

Issue: Container networking issues

Podman Compose Example: Complete Stack

Comparison with Docker

When to Choose Podman

When to Choose Docker

Can You Use Both?

Conclusion and Next Steps

Key Takeaways

When to Use Podman

Recommended Workflow

Next Steps

Related Guides

Resources