Cheat sheet

Podman

Daemonless, rootless container management — containers, pods, Kubernetes integration, and systemd.

Containers

# Run a container (rootless by default)
podman run -d --name web -p 8080:80 nginx:alpine

# Run interactively
podman run -it --rm ubuntu:24.04 bash

# List running containers
podman ps

# List all (including stopped)
podman ps -a

# Stop / remove
podman stop web
podman rm web

# Exec into a running container
podman exec -it web /bin/sh

Images

# Pull an image
podman pull docker.io/library/alpine:3.20

# List local images
podman images

# Build from Dockerfile
podman build -t my-app:v1 .

# Tag and push
podman tag my-app:v1 registry.example.com/my-app:v1
podman push registry.example.com/my-app:v1

# Remove unused images
podman image prune

Pods (multi-container)

# Create a pod
podman pod create --name mypod -p 8080:80

# Add containers to the pod
podman run -d --pod mypod --name web nginx:alpine
podman run -d --pod mypod --name sidecar alpine sleep 3600

# List pods
podman pod list

# Inspect pod
podman pod inspect mypod

# Stop / remove pod (and all its containers)
podman pod stop mypod
podman pod rm mypod

Kubernetes integration

# Generate K8s Pod YAML from a running pod
podman kube generate mypod > mypod.yaml

# Generate from individual container
podman kube generate web > web.yaml

# Run a K8s YAML locally (no cluster needed)
podman kube play mypod.yaml

# Tear down resources created by kube play
podman kube play --down mypod.yaml

# Note: podman generate kube and podman play kube
# were renamed in Podman v5 — use kube generate / kube play

Rootless & user namespaces

# Check if running rootless
podman info | grep rootless

# Map host UIDs for bind mounts
podman run --userns=keep-id \
  -v $HOME/data:/data:Z my-app

# Run as a specific user inside the container
podman run --user 1001:1001 my-app

# View user namespace mapping
podman unshare cat /proc/self/uid_map

Volumes & bind mounts

# Named volume
podman volume create mydata
podman run -v mydata:/data my-app

# Bind mount (add :Z for SELinux relabelling)
podman run -v /host/path:/container/path:Z my-app

# List volumes
podman volume ls

# Remove unused volumes
podman volume prune

Systemd integration

# Generate a systemd unit for a container
# Deprecated — Quadlet is the recommended replacement
podman generate systemd --new --name web \
  > ~/.config/systemd/user/container-web.service

# Enable and start
systemctl --user enable container-web
systemctl --user start container-web

# Enable Podman socket (for Docker-compatible API)
systemctl --user enable --now podman.socket
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock

Docker compatibility

# Podman is CLI-compatible — most docker commands work as-is
alias docker=podman

# Enable Podman socket for tools that use Docker socket
systemctl --user start podman.socket

# Docker Compose via podman-compose
pip install podman-compose
podman-compose up -d

# Or point docker compose at Podman socket
DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock \
  docker compose up -d

About the Podman cheat sheet

Podman's command set deliberately mirrors Docker's, so most Docker knowledge transfers directly and an alias covers the majority of everyday use. The differences that matter are architectural: there is no long-running daemon, and containers can run entirely as an unprivileged user.

Daemonless design changes the operational model. Each container is a child of the process that started it, so there is no central service to fail and take everything with it, and containers can be managed as systemd units like any other service. That last property is why Podman fits well on servers where systemd is already the supervisor.

Rootless is the headline security feature and the source of most surprises. Containers run in a user namespace where root inside maps to your unprivileged user outside, so a container escape lands as a normal user rather than as root. The cost is that low ports, some networking and certain volume ownership behaviours work differently.

Frequently asked questions

Can I use Docker commands with Podman?

Largely yes — the CLI is intentionally compatible and aliasing docker to podman works for most everyday commands. Differences appear around anything assuming a daemon or a Docker socket. Podman can expose a compatible socket for tools that require one, which covers most of the remaining gap.

Why can my rootless container not bind port 80?

Unprivileged users cannot bind ports below 1024. Publish a high port and put a reverse proxy in front, or lower the unprivileged port threshold at the system level if you control the host. Running the container as root to get the port defeats the main reason to use rootless.

What are pods in Podman?

A pod groups containers sharing a network namespace, the same concept Kubernetes uses. Containers in a pod reach each other on localhost, which makes it a genuinely useful way to model a sidecar arrangement locally. Podman can also generate Kubernetes YAML from a running pod, which is handy for moving a local setup toward a cluster.

How do I run containers as services?

Generate systemd units from containers or pods, or use Quadlet, which lets you declare containers as systemd unit files directly. This is the idiomatic approach on a server: the container becomes an ordinary service with normal dependency handling, logging and restart policy, supervised by systemd rather than a container daemon.

Does rootless affect volume permissions?

Yes, and it is the most common friction point. User namespace mapping means a file owned by your user outside appears with a different ownership inside, so a container process may be unable to write to a bind mount that looks correct. Use the relabel and user-namespace mount options rather than loosening permissions on the host directory.