podman

Run container rootless Start a detached nginx container without root privileges podman run -d --name web -p 8080:80 nginx:alpine #podman#containers Build image Build from a Containerfile (Dockerfile-compatible) podman build -t myapp:latest -f Containerfile . #podman#containers Generate systemd unit Create a systemd unit to manage the container lifecycle podman generate systemd --new --name web > ~/.config/systemd/user/web.service #podman#containers#systemd Play Kubernetes YAML Run a pod from a Kubernetes manifest (local testing) podman play kube deployment.yaml #podman#containers#kubectl Export pod as Kubernetes YAML Generate a Kubernetes-compatible manifest from a running pod podman generate kube mypod > pod.yaml #podman#containers#kubectl Create and use a pod Group containers into a pod sharing network namespace podman pod create --name mypod -p 8080:80 && podman run -d --pod mypod nginx:alpine #podman#containers Inspect image layers List filesystem layers of an image podman image inspect myapp:latest | jq '.[0].RootFS.Layers' #podman#containers#debug List all containers including stopped Show all containers with name, status and image podman ps -a --format '{{.Names}}\t{{.Status}}\t{{.Image}}' #podman#containers Remove all stopped containers Non-interactively delete all exited containers podman container prune -f #podman#containers Login to registry Authenticate with a container registry podman login registry.example.com -u myuser #podman#containers Container as systemd unit Emit a portable .service that recreates the container on start; note: Quadlet is the modern way podman generate systemd --new --files --name <name> #podman#systemd#gitops Export pod to Kubernetes YAML Reverse-engineer a running pod into a K8s manifest for migration to a cluster podman generate kube <pod> > pod.yaml #podman#k8s#gitops Run Kubernetes YAML locally Spin up pods/services from a K8s manifest with no cluster; --replace re-applies cleanly podman play kube pod.yaml --replace #podman#k8s#troubleshooting Rootless port/uid mapping debug Inspect the user-namespace uid range backing rootless containers; fix perms via chown inside unshare podman unshare cat /proc/self/uid_map; cat /etc/subuid #podman#security#rootless#troubleshooting Auto-update from registry Pull newer images and restart labeled containers; needs io.containers.autoupdate=registry label podman auto-update --dry-run && systemctl --user start podman-auto-update #podman#ci#gitops#security Migrate storage after upgrade Refresh OCI runtime and user-namespace config after a podman/kernel upgrade; fixes stale containers podman system migrate #podman#troubleshooting#kernel