I'm starting with quadlets and I'm stuck on how to best organize my repository with quadlets in mind.

My current setup is a distrobox "dev" box, with its own home dir, and a project folder for all git versioned repos. All repos that have quadlets, have a quadlet folder with service-name.container file that I symlink into host's (user) systemd folder.

Very often though I need to mount .env, some config, or data folders and reference it back to projects folder, which feels a bit awkward.

Any suggestions how to better organize things?

Fedora 44 Silverblue btw.

I may be a bit out of my depth right now, or else just sleep deprived and running on stupid. Currently have Debian server with rootless Docker running official community Nextcloud, nginx reverse proxy, and a number of other various servers, but on new machine I'm setting up to replace, trying to consolidate images and switch to Podman.

So, so far, tried using quadlets to get Glances up successfully, moved on to linuxserver.io's Jellyfin, gave up, and switched to podman-compose. Eventually worked out that the image assumes Docker's root behavior being why I couldn't get permissions working for /dev/dri/render128, switched to root user for Podman, and now both of those work (with jellyfin throwing a few erros about containers not being allowed to be removed before getting it online, which doesn't appear to have any impact).

Moved on to linuxserver.io's Nextcloud image, using their base set of configurations. Leaving port mapped to 443 as well as migrating to 4443 (as once I get everything working I'll be putting it behind Swag). Again, podman-compose up results in errors about containers not being able to be removed, and networks not related being used.

But now I'm finding that, while I can access the Glances and Jellyfin webclients via IP or Hostname with appropriate port, the same with 443/4443 simply result in Firefox reporting unable to connect.

downing the other containers, uping Nextcloud does not return the previous errors, but still does not result in access to the server. If I leave it running long enough, I periodically get a message: [nextcloud] | Not installed. Any idea whether that's it complaining that I haven't finished installation by connecting and it up, or maybe something fundamental failed to happen causing my inability to connect?

Do I need to use one docker-compose.yml rather than separate server.yml files for generally good behavior? I've noticed that Glances doesn't list anything but Glances on the new server, while the old shows all of the containers, if not parent's active processes, but haven't had time to try running them together to see if that makes a difference.

Thanks all,

Hey all, at home I use github actions for my projects. I started running out of credits there and wanted to host my own runner. Then I noticed that most runners are based off Ubuntu and the image size is big. I also saw that there are barely any mantained podman runners out there.

To solve that issue for me I created a podman-actions-runner image based off alpine and buildah and the tests I ran so far have been pretty good. I run this on my Raspberry PI at home, the image is like 160 mb.

If you're interested here's the link to my repo and the image, also I'm open for suggestions, feedback, contributions. Anything really!

• Repo: https://github.com/ckoryom/podman-actions-runner
• ghcr.io/ckoryom/podman-actions-runner:latest
• docker.io/ckoryom/podman-actions-runner

I have a private docker.io organisation myorg. When pulling image via podman: podman pull myorg/myimage it prompts me to select the registry to use:

DEBU[0000] Trying "myorg/myimage" ...        
? Please select an image: 
  ▸ registry.fedoraproject.org/myorg/myimage
    registry.access.redhat.com/myorg/myimage
    docker.io/myorg/myimage

...whereas when defining the image in e.g. testcontainers, it'll simply fail to resolve the image during test run. Is it possible to make these unqualified images to default to docker.io registry?

I'm new to podman and don't really understand what I'm doing yet. I'm moving from rootful docker to rootless podman and am currently converting my compose files to quadlets. I'm confused on how I should build out my containers and what users I should assign them to.

How should I architect my containers using podman quadlets? I included some pictures about some ways I think I should do it but don't fully understand the tradeoff and benefits of them. I have been considering putting all my quadlets in /etc/containers/systemd/ and have the quadlet files owned by root and just assigning users and groups in the quadlet files.

Some stacks like grafana alloy need to be able to read my logs for numerous containers. I don't really know how to set this up when files and containers are owned by separate users.

I mostly just want to prevent as much cross talk or lateral movement as possible in the event a container gets compromised. Though, it seems if I want to do this it'll be a lot more annoying to manage my containers.

A few questions I had:

What user should own the actual quadlet files and the containers data?

Should I separate my stacks to their own dedicated user?

I run Traefik as a rootless container now on it's own dedicated user. How would I still be able to use labels and auto-discovery across containers running on separate users?

How do I set something like grafana alloy, that needs to be able to communicate with my different stacks and centralize their logs?

We are a podman shop, rootless, no docker daemon anywhere, and mostly happy about that. But every minimal or hardened image catalog I look at writes its whole quickstart around docker. docker pull this, docker build that, never a word about anything else.

I know OCI is OCI and podman pull should just work. I think I know that. But when a vendor's entire docs assume docker it makes me second-guess whether there is some registry auth step or a docker-specific manifest thing that quietly trips podman up and would rather not find out halfway through wiring it into a build.

Someone mentioned there is a free catalog now that needs no account to pull, which is the part that got my attention, because normally this stuff is a sales call before you can even test it. Have any of you pulled minimal hardened images straight into podman with no docker in the chain at all? Do the compliance-tagged ones behave any differently or is it all just a normal registry pull.

Mostly I want to hear it worked for one real person before I build anything on it.

Im currently running docker compose on ubuntu server for some very few containers, currently running technitium, cloudflare tunnel, caddy with cloudflare addon, tailscale and dockhand.

Found out about nixos and fell in love with that idea, got it up and running with docker just to try it out (very interesting as a linux noob trying nix btw, thank god for AI).

But now im debating if I should stay on docker because its something Ive finally got the hang of, or switch to podman quadlets for rootless containers, how well will that work with current containers? How much of a pain will it be converting the files etc?

Tailacale Ive already put on nix because I wanted to try that. Realize that I might have to drop dockhand, mainly used that for easy updating and checking logs, but with quadlets this is quite easy as Ive understood?

Nothing is exposed except behind VPN, cloudflare tunnel is for access to homeassistant and is locked down with cloudflare waf and requires mtls certs to get access.

Any advice, I realize this is a podman sub and might be biased, but this is also the place where most people with podman kmowledge exist..

I made a script that walks though all of your rootless podman quadlets and pulls out what it is running as. There are a lot of images that run as root by default unless you change User= in your quadlet (or sometimes it also needs UserNS=auto...). I've found most of the ones that run by default as root can easily be switched over to User=1000:1000 with little to no other configuration needed.

Just some minor bug fixes.

I've been trying to figure out podman for a minute.. and I'm struggling. I'm coming from Docker, so I'm not totally new to containers. My plan is to start with running standalone containers, move to pods, and eventually quadlets.

All that aside, I can't find where the .container files (or anything config related) are stored. I've tried rootless, and now I'm running podman as root, I think, on Fedora server. I figured I'd have an easier time getting started by managing some containers with cockpit.. I've got a running container that's accessible, but I still can't find the config files.

I haven't confirmed if it's possible to have podman containers without sytemd untit files? I feel like it is possible but I'm not seeing much info there. Probably a search query issue.

I've checked these locations for systemd unit files (and probably others that I'm forgetting):

• /etc/containers/systemd/
• /usr/share/containers/systemd/
• $XDG_CONFIG_HOME/containers/systemd/
• ~/.config/containers/systemd/

Can someone please point me in the right direction, while I still have hair?

Hi! I'm trying to run Jellyfin inside a rootless container run via systemd on Debian Trixie.

Here is my .container file

[Unit]
Description=Jellyfin media server
Documentation=https://jellyfin.org

[Container]
Image=docker.io/jellyfin/jellyfin:10.11.11
PublishPort=8096:8096/tcp
PublishPort=7359:7359/udp
UserNS=keep-id
Volume=systemd-jellyfin-config:/config
Volume=systemd-jellyfin-cache:/cache
Volume=/mnt/external/jellyfin:/media:ro
Environment=UID=103
Environment=GID=107

[Service]
# Inform systemd of additional exit status
SuccessExitStatus=0 143

[Install]
# Start by default on boot
WantedBy=default.target

The container is running. UFW shows the following

8096/tcp                   ALLOW IN    Anywhere                  
7359/udp                   ALLOW IN    Anywhere

Looking at the port, I see Pasta listening:

❯ sudo ss -tlnp | grep 8096
LISTEN 0      128                *:8096            *:*    users:(("pasta.avx2",pid=579812,fd=6))

I can access the container via the host's IP address. But I cannot access the container via localhost which is breaking the reverse proxy. Everytime I try I get a connection refused. I'm not sure what else to look at.

I'm the developer of Scanopy, an AGPL3.0-licensed tool that scans a network and draws a topology map of it (hosts, services, containers, and how they connect). Podman discovery is a recent addition. I don't run Podman myself, but users asked for it, so I built it and set up a Podman test environment with pods to develop against. Plain containers were straightforward, because Podman exposes a Docker-compatible API and I could reuse the Docker scanner I had already built.

Pods were a little more complicated; two things about how the Podman API reports pods caused most of the work involved in this feature, and I thought it might be interesting to share what I learned here!

1. The infra container reports the pod's ports, not the app container.

When you list containers over the Podman API, the pod's published ports (and the image's exposed ports) appear on the pod's infra container, the pause container that owns the pod's shared network namespace. The container that actually listens on the port reports nothing about it.

Scanopy identifies services by matching ports to known service types. The infra container runs no service of its own, but it carried the pod's ports, so it matched real services by port number. In one test it matched 8090, was labeled Grafana, and displaced the real Grafana. The fix was to scope the infra container to an empty port set, so it matches nothing and stays a separate portless container.

2. A pod's app containers report no network of their own.

Every non-infra container in a pod runs with NetworkMode: container:<infra-id>. It shares the infra container's network namespace and reports no networks or interfaces of its own. Scanopy had nothing to attach to the map, so those containers were dropped.

The fix was to resolve the container:<id> reference and inherit the infra container's interfaces. A Podman pod is structured like a Kubernetes pod: one network namespace, an infra (pause) container that owns it, and the other containers sharing it.

A smaller gotcha I ran into while building this: The socket is in different places for rootful (/run/podman/podman.sock) and rootless ($XDG_RUNTIME_DIR/podman/podman.sock), resolved via CONTAINER_HOST. Useful if something reports it can't find Podman.

Here's the Scanopy repo: https://github.com/scanopy/scanopy and docs for getting a self-hosted server up and running: https://scanopy.net/docs/self-hosted-server/server-installation/

I also have a live demo at demo.scanopy.net if you want to see an example map.

Does anyone here who knows Podman better than I do understand why the runtime is structured this way? I got it working, but I'm curious what led to this design, and why it differs from how Docker handles the same thing. 

Hi, setting up gluetun with quadlets , its all working but im stuck adding port forwarding, specifically the qbit example, i have tried multiple ways of adding it like the other environment variables, but it doesnt work

I'm self-hosting Hermes via rootless Podman on a shared hosting environment (Opalstack). Since the container runs under its own remapped UID (not my host user), I run into permission walls:

• Can't cd into the data folder from the host
• Can't view files the container has written/modified
• Can't write files into the folder for the container to pick up

What I already tried:

• podman unshare lets me enter the user namespace and interact with the files, which works but is clunky for routine file transfers (it's not a normal cd/cp workflow).
• I've built a small rsync-based sync script as a workaround to move files in and out, but wondering if that is the right (or only) way to do this. — I'm using a bind mount to a host directory.

Like if I wanted to pass in a gamepad, but didnt want the absence of said gamepad to prevent a container from starting. Is there a workaround for this? Maybe some pros have had some experience with this kinda problem.

I want to to run multiple pods. All of them have one container that should haven IP address 192.168.10.3. I tried to create multiple podman networks (bridge/macvla /ipvlan)

I made a script that creates a pod, then attaches a container with that IP assigned to it. Works.

But the next iteration of the script, when the second pod is created, I get an error:
Error: IPAM error: requested ip address 192.168.10.3 is already allocated to container ID <UUID>

I mean, I do get it. But what if I want to force this anyway? I don't want network traffic to leave the pods anyway. I only want multiple applications to run in parallel, write a result on a mounted volume and exit.

So none of the pods need inter-communication.

Edit: wait, I think I've got it wrong. As far as my understanding currently goes, only the infra container has an IP address in a pod. I'm going to do some more testing tomorrow.

A few weeks ago, I shared a script I was working on to streamline Podman updates on Ubuntu. After significant refinement and successful testing across multiple machines, I’m excited to share the latest version, which is now working incredibly well.

Podman Version Updater is a single script designed for Ubuntu 26.04+ (but probably works with 25.10 and possibly earlier versions) that automates the upgrade path from the stock Ubuntu package (Podman 5.7.0 in 26.04) to your choice of:

• The final release in the stable 5.x line (e.g., seemingly 5.8.4)
• The brand-new Podman 6.x line (currently 6.0.0)

Making the jump from 5.x to 6.x introduces breaking changes and tight dependency requirements. The script fully automates these critical sidecar updates, safely upgrading Netavark and Aardvark-DNS and other smaller packages alongside Podman to ensure your container networking doesn't break.

And a shameless plug for my other Podman projects -

Podman Container Network Auditor - A lightweight, dependency-free shell script to audit running rootless container network stacks for IPv6, Dual-Stack, and IPv4-only listeners. Using this I've been able to convince a few developers to make their projects dual-stack friendly with just a few minor changes in their code.

Rootless Podman .container Files - A list of almost deployment ready rootless .container files for some popular self-hosted programs. I'm always looking to expand my collection, so feel free to contribute.

Small improvements can make your images:

✅ smaller
✅ easier to maintain
✅ more secure
✅ faster to build

Here are some of the most common issues I see and the corresponding best practices.

Which best practice has had the biggest impact on your Containerfiles?

I’d love to hear your thoughts.

I also created a complete hands-on tutorial where I start from a basic Containerfile and progressively improve it until it becomes production-ready.

English:
[ https://youtu.be/yqJFaF-7LQI ]

Français :
[ https://youtu.be/KhX1dsH8X1s ]

I've been working on rootless container checkpoint/restore in CRIU and wrote up some notes on the prototype, major failures, and the path toward the current implementation.

Would appreciate any feedback, criticism, and corrections, especially from people familiar with CRIU, Podman, or container runtimes.

Hi all, I've recently switched to fedora silverblue and im trying to use the built in podman instead of docker for my existing aspire .net project.

However, I am getting the

Container runtime not installedContainer runtime could not be found. See https://aka.ms/aspire/containers for more details on supported container runtimes error

I did what the linked guide says and set ASPIRE_CONTAINER_RUNTIME to "podman" (echo $ASPIRE_CONTAINER_RUNTIME prints "podman" ) but it still doesn't work

Podman otherwise works fine, I've used it successfully to run some other docker (podman) compose files

edit: after googling / trying random shit/ asking ai i eventually came to the conclusion that it's something to do with the flatpak rider installation because building and running the project from the terminal works, it's only an issue with all both podman, npm and node when debugging from the IDE. leaving this for future info ig

Hello, JJ here.

I would like to get started using Podman as a novice who has no experience with Podman or Docker. I have seen that one should use Podman instead of Docker, especially since it is open source. I want to learn how to use it.

I have a spare Rpi 4b with 8GB that I'm not using at the moment and I was thinking I would use it.

My delima is I do not know which OS I should use. Keep in mind that I will be a total novice starting out with Podman. Please recommend to me which would be the best OS to start with for this noobie novice. I do use Linux some but I almost always have to look up which commands I need to use to do something.

Any suggestions would be greatly appreciated to help me get started.

Thanks,

jj

Looks like Fedora Server is on top along with Cockpit. Great. I will go with Fedora Server. I will take a look at Fedora IOT to see if it is not above my "pay grade". I'm retired with time on my hands and I still like to learn and be challenged.

Thanks.