DevOps

Podman

Podman is a daemonless container engine with rootless support, a Docker-compatible CLI and the notion of a pod.

Official siteRepository

What it is

Podman is developed by Red Hat and appeared in 2018 as a Docker alternative. The main differences: no long-running daemon (each container is a child process of the user) and strong rootless support: containers run without root rights.

The commands almost match Docker, often alias docker=podman is enough. Podman works with the same OCI images, can build them through Buildah and run groups of containers as pods, like in Kubernetes. It can also generate Kubernetes manifests from running containers.

Systemd integration allows running containers as services (Quadlet). For Mac and Windows there is Podman Desktop.

Use it when

  • You need containers without root and without a daemon for security reasons.
  • You work on RHEL, Fedora or servers where Podman is the standard.
  • You want to run containers as systemd services.
  • You need to move away from Docker without changing images.

Avoid it when

  • The team and tools are tightly tied to the Docker API and the Docker Compose ecosystem.
  • You need maximum compatibility with docs and CI recipes that assume Docker.

Key concepts

Daemonless
No central background process: the user launches containers directly, so there is no single point of failure.
Rootless
Containers run as an ordinary user, which reduces risk from vulnerabilities.
Pod
A group of containers with a shared network, as in Kubernetes.
Quadlet
Describing containers in systemd files so they start as ordinary services.

Example

Running a container without root, exporting to a Kubernetes manifest and creating a pod.

Interview questions

  1. 1. How does Podman differ from Docker?

    Podman has no central daemon and rootless is the main mode. Commands are Docker-compatible, but containers are ordinary user processes, and there is also the notion of a pod.

  2. 2. What does rootless give?

    The container runs without root rights on the host. Even if an attacker escapes the container, they get only ordinary user rights, so the risk is lower.

  3. 3. Do Docker images work in Podman?

    Yes, Podman works with OCI images and can pull from Docker Hub. A Dockerfile builds through Buildah or podman build.

Comparisons with this technology

Related technologies

Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).

Explore the platform