Podman: containers without a daemon and without root

Podman differs from Docker in two ways that change operations more than the command line does. It has no permanently running daemon with root privileges – a container is a child of the process that started it. And it can run rootless, with the user namespace mapped onto the id ranges in /etc/subuid and /etc/subgid.

The practical consequence is how things start after a reboot. Instead of a daemon remembering what should run, a container produces a systemd unit (podman generate systemd) and init takes care of starting it like any other service – with the same locking, dependencies and logging. The 4.0 release of February 2022 also replaced the networking layer with netavark for new installations; existing ones stayed on CNI.

Later development: since version 4.4, Quadlet replaces podman generate systemd – the unit is described by a .container file and systemd generates the service from it. podman generate systemd has been deprecated since then.