Podman fundamentals

Start with containers and images, then distinguish Podman's local management model, rootless permissions, and optional API service.

Prerequisite: what is a container? A beginner's guide#

An analogy

Imagine sending a friend a fully assembled computer. You have two options:

• Virtual machine: box up the entire computer, including its case, power supply, and motherboard → bulky, with each computer carrying a complete operating system
• Container: remove the CPU, memory, and disk, and ship them in a standardized foam box → lightweight, containing only the application and its direct dependencies

The core idea of containers: package an application and all its dependencies into a standard unit that provides consistent user-space dependencies in a Linux environment with the required CPU architecture, kernel capabilities, and runtime conditions.

Containers vs. virtual machines

虚拟机：
┌─────────────────────────────┐
│ App A    │ App B            │  ← 每个 App 带自己的 OS
├──────────┼──────────────────┤
│ Guest OS │ Guest OS         │  ← 完整操作系统（几 GB）
├──────────┴──────────────────┤
│ Hypervisor (KVM/VirtualBox) │
├─────────────────────────────┤
│ Host OS (Linux)             │
└─────────────────────────────┘

容器：
┌────────────┬────────────┐
│ App A      │ App B      │  ← 各自独立的依赖
├────────────┴────────────┤
│ Container Runtime       │  ← 轻量运行时
├─────────────────────────┤
│ Host OS (Linux)         │  ← 只有一个操作系统
└─────────────────────────┘

The key difference: containers share the host's Linux kernel, so each container does not need a complete operating system installed inside it. As a result:

• Containers usually avoid the startup cost of a separate guest kernel, and lightweight tasks often start quickly.
• Actual startup time depends on image pulls, application initialization, mounts, and networking.
• The number of containers you can run depends on workloads, memory, and resource limits; a fixed memory capacity does not imply a fixed instance count.

The two core ingredients of containers

1. Image: a read-only template containing everything needed to run a program: code, libraries, and configuration files. For example, the docker.io/library/nginx:alpine image contains the Nginx web server and all the files it needs.
2. Container: a "running instance" of an image. An image is like a software installation package; a container is like the running program itself.

# 镜像 → 容器 的关系
podman pull docker.io/library/nginx:alpine     # 下载镜像（安装包）
podman run docker.io/library/nginx:alpine      # 从镜像启动容器（运行程序）

What is Podman?#

Podman (Pod Manager) is an open-source container-management tool from Red Hat. Its command-line interface is almost identical to Docker's. In most cases, you only need to replace docker with podman.

But that is only the surface. Podman and Docker have fundamentally different underlying architectures.

The key difference: a daemonless architecture

graph TD
    subgraph "Docker 架构"
        DC["docker CLI"] -->|REST API| DD["dockerd<br/>守护进程<br/>(通常常驻，可 rootful/rootless)"]
        DD -->|gRPC| CR["containerd"]
        CR --> RUNC["runc"]
    end
    subgraph "Podman 架构"
        PC["podman CLI"] -->|直接 fork/exec| PM["conmon<br/>容器监控进程"]
        PM --> CRUN["crun / runc"]
    end

Issues with Docker:

• The local Docker CLI usually manages resources through the dockerd API; the daemon incurs state-management and resource costs.
• A typical rootful Docker daemon has host administrator capabilities; Docker also offers rootless mode.
• An unavailable daemon affects management operations. Whether running containers continue depends on live-restore and the runtime design; it is inaccurate to say they all stop.
• The dockerd API socket is a well-known security attack surface

Podman's approach:

• Local CLI management does not require a persistent central daemon, though running containers still involve processes such as conmon and an OCI runtime.
• Ordinary users can run rootless Podman; the specific container UID also depends on userns mappings and the application's user in the image.
• One container crashing does not affect other containers
• API sockets and remote workflows can enable the Podman service on demand; this does not mean there are no background processes at all.

In one sentence

Docker uses a "client-server" model: you ask a caretaker to do the work. Podman uses a "direct execution" model: you do the work yourself. This is a difference in the management interface; security still depends on rootful/rootless operation, socket permissions, and runtime configuration.

Rootless: run containers without root#

This is Podman's biggest security selling point.

What does rootless mean?

In a rootful configuration without user-namespace mappings, container UID 0 corresponds to host UID 0, but remains constrained by namespaces, capabilities, seccomp, SELinux, and similar mechanisms. Overly broad host mounts and additional privileges are particularly dangerous:

• Deleting the container's own / usually affects its filesystem view; a writable host-directory mount can also expose that directory's data to destruction.
• Writable host mounts combined with elevated privileges can expose host files, so the authorized scope must be restricted.

In Podman's rootless mode, root inside the container maps to an ordinary user on the host. The container process "thinks" it is root, but actually has only ordinary-user permissions on the host.

默认 rootful 无 userns 映射：容器 UID 0 通常对应宿主 UID 0
默认 rootless 映射：容器 UID 0 通常对应调用者普通 UID

Practical effect: rootless reduces exposure of host administrator privileges, but the shared kernel, accessible sockets, and user data remain risks. It is not an absolute isolation guarantee after a container is compromised.

Key prerequisites for user mappings

The /etc/subuid and /etc/subgid files assign each user a range of "virtual UIDs":

# /etc/subuid
user:100000:65536
# 含义：user 可以"扮演"100000 到 165535 这 65536 个 UID
# subordinate 区间不意味着 UID 0 自动映射到 100000；默认通常把调用者映射为容器 root

When creating a rootless container, Podman automatically uses newuidmap/newgidmap to configure user-namespace isolation.

Version changes: do not attribute every new feature to 5.0#

When should you use Podman, and when Docker?#