Podman Overview¶

What is Podman?¶

Podman (Pod Manager) is a daemonless, open-source container engine developed by Red Hat for managing OCI (Open Container Initiative) containers and pods on Linux systems.

Architecture¶

Daemonless Design¶

Unlike Docker, Podman doesn't require a daemon: - Each container runs as a child process of the Podman command - No single point of failure - Better security isolation - Direct fork/exec model

Docker Architecture:
User → Docker CLI → Docker Daemon → containerd → runc → Container

Podman Architecture:
User → Podman CLI → runc/crun → Container

Components¶

Podman¶

Main CLI tool for container management
Compatible with Docker CLI
Manages containers, images, and pods

Buildah¶

Specialized tool for building container images
More flexible than docker build
Can build images without Dockerfile

Skopeo¶

Tool for working with container images
Copy, inspect, delete images
Works with multiple registries

CRI-O¶

Container runtime for Kubernetes
Lightweight alternative to Docker
OCI-compliant

Core Concepts¶

Containers¶

Isolated processes running from container images: - Lightweight and portable - Share host kernel - Isolated filesystem, network, and process space

Images¶

Read-only templates for creating containers: - Layered filesystem - Stored in registries - Can be built from Dockerfile

Pods¶

Group of one or more containers: - Share network namespace - Share storage volumes - Similar to Kubernetes pods - Managed as a single unit

Registries¶

Storage for container images: - Docker Hub - Quay.io - Red Hat Registry - Private registries

Rootless Containers¶

What are Rootless Containers?¶

Containers that run without root privileges: - Enhanced security - User namespace mapping - No daemon running as root

Benefits¶

Security: Reduced attack surface
Multi-tenancy: Safe user isolation
Compliance: Meets security requirements
No sudo: Users can run containers without root

How it Works¶

# User namespace mapping
Host UID 1000 → Container UID 0 (root)
Host UID 1001 → Container UID 1
Host UID 1002 → Container UID 2

OCI Compliance¶

Podman follows OCI standards: - OCI Runtime Spec: How to run containers - OCI Image Spec: How to build images - OCI Distribution Spec: How to distribute images

This ensures compatibility with other OCI-compliant tools.

Podman vs Docker¶

Similarities¶

Compatible CLI commands
Uses same image format
Works with Dockerfiles
Pulls from Docker Hub
Similar networking concepts

Differences¶

Architecture¶

Docker: Monolithic daemon
Podman: Daemonless, fork/exec model

Security¶

Docker: Daemon runs as root
Podman: Rootless mode available

Pods¶

Docker: No native pod support
Podman: Native pod support

systemd¶

Docker: Limited integration
Podman: Full systemd integration

Use Cases¶

Development¶

Local development environment
Testing microservices
Building CI/CD pipelines
Container image creation

Production¶

Running containerized applications
Microservices architecture
Edge computing
IoT devices

Security-Critical¶

Multi-tenant environments
Compliance requirements
Rootless deployments
Air-gapped systems

Kubernetes Development¶

Test Kubernetes YAML locally
Develop pod configurations
Simulate K8s environments

Advantages¶

Security¶

Rootless containers by default
No daemon running as root
Better process isolation
SELinux integration

Simplicity¶

No daemon to manage
Simpler architecture
Easier troubleshooting
Less resource overhead

Compatibility¶

Drop-in Docker replacement
Works with existing Dockerfiles
Compatible with Docker images
Kubernetes YAML support

Integration¶

Native systemd support
Generate unit files
Auto-start containers
Journal logging

Limitations¶

Docker Compose¶

Requires podman-compose (separate tool)
Not 100% compatible with docker-compose
Some features may not work

Swarm¶

No Docker Swarm equivalent
Use Kubernetes for orchestration
Or use systemd for simple setups

Windows/macOS¶

Requires VM (Podman Machine)
Not as native as on Linux
Some features limited

Ecosystem¶

Smaller ecosystem than Docker
Fewer third-party tools
Growing but not as mature

Getting Started¶

Installation¶

# RHEL/Fedora
sudo dnf install podman

# Ubuntu
sudo apt-get install podman

# Verify
podman --version

First Container¶

# Pull image
podman pull nginx

# Run container
podman run -d -p 8080:80 nginx

# Check status
podman ps

# View logs
podman logs <container-id>

# Stop container
podman stop <container-id>

Docker Compatibility¶

# Create alias
alias docker=podman

# Now use Docker commands
docker run -d nginx
docker ps
docker images

Architecture Deep Dive¶

Process Model¶

User runs: podman run nginx
    ↓
Podman CLI parses command
    ↓
Podman creates container config
    ↓
Podman calls runc/crun
    ↓
Container process starts
    ↓
Podman exits (for detached containers)
    ↓
Container runs independently

Storage¶

Podman uses different storage drivers: - overlay: Default, efficient layering - vfs: Simple, no special features - btrfs: For btrfs filesystems - zfs: For ZFS filesystems

Networking¶

Podman networking modes: - bridge: Default, isolated network - host: Use host network - none: No networking - container: Share another container's network - Custom networks: User-defined networks

Best Practices¶

Use Rootless: Run containers without root when possible
Pods for Multi-Container: Use pods instead of linking containers
systemd Integration: Use systemd for production services
Image Security: Scan images for vulnerabilities
Resource Limits: Set CPU and memory limits
Logging: Configure proper logging
Updates: Keep Podman and images updated
Backups: Backup volumes and configurations

Next Steps¶

Continue to: - Installation - Detailed installation guide - Basic Commands - Essential commands - Images - Working with images - Containers - Container management