podman

Here's an example of a bug that I filed about non-actionable error messages: https://github.com/karmab/kcli/issues/456 The first error message was "No usable public key found, which is required for the deployment" which doesn't tell me what I have to do to correct the problem. Nothing about even where it's looking for keys, what is supposed to create the key or how I am supposed to create the key. There are other examples and discussion of what they should say in the link. Edit: Here's another one that I filed: https://github.com/containers/podman/issues/20775

For production workloads, you can use systemd socket activation to avoid most of the network issues. The caddy demo I've linked below explains more about the issues it would solve. [0] https://github.com/containers/podman/blob/main/docs/tutorial... [1] https://github.com/eriksjolund/podman-caddy-socket-activatio...

For some context, Passt is used by podman for rootless networking (by default from Podman 5.0) It is a noticable improvement for traffic heavy containers. https://github.com/containers/podman/blob/main/docs/tutorial...

Well all the downstream distros have their own installers (apt, dnf, pacman, etc.). If you're compiling from source, then "make install" [0] should work as expected, and if you're downloading the pre-built binaries from GitHub [1], you just need to copy a single statically-linked binary into "/usr/local/bin". [0]: https://github.com/containers/podman/blob/c8183c50/Makefile#... [1]: https://github.com/containers/podman/releases

I mean I get the overall benefits of having rootless and all, but the premise of security in this article is a bit misleading. Obviously having a daemon running as root is larger attack surface than a program running as the user. Going to the github.com/containers/podman/releases, the latest release is actually addressing a security risk that involves overwriting files of the host. # v5.6.1 (Latest) ## Security - This release addresses CVE-2025-9566, where Kubernetes YAML run by podman play kube containing ConfigMap and Secret volumes can use crafted symlinks to overwrite content on the host. As always, the most secure computer is the one that is unplugged & turned off.

> Rootless networking is very slow unless you install `passt`. If the software that you're running inside the container supports it, you can use socket activation [0] to get native performance. [0]: https://github.com/containers/podman/blob/main/docs/tutorial...

They publish statically-linked binaries on GitHub [0], so to install it, you just need to download and unpack a single file. But you don't get any automatic updates like you would if they provided an apt repository. [0]: https://github.com/containers/podman/releases

I'm a podman user and fan, but there is one gotcha to know about the systemd integration. You might expect that setting User=foo via systemd would enable seamless rootless containers, but it turns out to be a hard problem without a seamless solution. Instead, there's this discussion thread with 86 comments and counting to wade through to find some solutions that have worked for some people in some cases. https://github.com/containers/podman/discussions/20573#discu...

Tried Podman. It looked quite promising, but failed me: https://github.com/containers/podman/discussions/26899 Trying Incus now

(I'm a big podman stan) Last I tried using the .kube files I ran into issues with specifying container networks (https://github.com/containers/podman/issues/12965). This is sort of "fixed" by using a Quadlet ".kube" but IMO that's a pretty weak solution and removes the "here's your compose file, run it" aspect. Recently (now that Deb13 is out with Podman 5) I have started transitioning to Podmans Quadlet files which have been quite smooth so far. As you say, its great to run things without all the overhead of kubernetes.

Neat. I like to see other takes on this. Any reason to use rootless vs `userns=auto`? I haven't really seen any discussion of it other than this issue: https://github.com/containers/podman/discussions/13728

I found Dan's recommendation to use rootful with `userns=auto`: > User= causes lots of issues with running podman and rootless support is fairly easy. I also recomend that people look at using rootful with --userns=auto, which will run your containers each in a unique user namespace. ― https://github.com/containers/podman/issues/12778#issuecomme...

That workaround is not needed if the web server container supports socket activation. Due to the fork-exec architecture of Podman, the socket-activated socket is inherited by the container process. Network traffic sent over this socket-activated socket has native performance. https://github.com/containers/podman/blob/main/docs/tutorial...

I really like rootless podman, but there is one quirk in that if you want to preserve the original source IP address (e.g. for web server logs), you have to use a workaround which has a performance penalty. https://github.com/containers/podman/issues/10884 https://github.com/containers/podman/pull/9052 https://github.com/containers/podman/pull/11177

It appears that systemd User= and DynamicUser= is incompatible with Podman so --user is being used as a replacement. Looks messy. https://github.com/containers/podman/discussions/20573