podman

Name: podman
Author: BagelHole

42stars4forks

How to install podman?

bagelhole/devops-security-agent-skills/podman

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill podman

Installs into the current project.

Summary

Manage containers using Podman, the daemonless container engine. Run rootless containers, create pods, manage images, and use Docker-compatible commands. Use when working with Podman or requiring rootless container operations.

Files · 1

View on GitHub

SKILL.md

1	# Podman
2
3	Run and manage containers without a daemon using Podman's rootless container engine.
4
5	## When to Use This Skill
6
7	Use this skill when:
8	- Running containers without root privileges
9	- Managing containers on systems without Docker
10	- Creating pod-based container groups
11	- Using systemd for container management
12	- Working in security-conscious environments
13
14	## Prerequisites
15
16	- Podman installed (4.x+)
17	- For rootless: user namespaces enabled
18	- Basic container concepts understanding
19
20	## Key Differences from Docker
21
22	\| Feature \| Docker \| Podman \|
23	\|---------\|--------\|--------\|
24	\| Architecture \| Client-daemon \| Daemonless \|
25	\| Root required \| Default \| Optional (rootless) \|
26	\| Pod support \| No \| Yes (Kubernetes-style) \|
27	\| Systemd integration \| Limited \| Native \|
28	\| Socket \| docker.sock \| podman.sock (optional) \|
29
30	## Basic Commands
31
32	### Container Operations
33
34	```bash
35	# Run container (identical to Docker)
36	podman run -d --name webserver -p 8080:80 nginx
37
38	# List containers
39	podman ps -a
40
41	# Stop and remove
42	podman stop webserver
43	podman rm webserver
44
45	# Execute command
46	podman exec -it webserver /bin/sh
47
48	# View logs
49	podman logs -f webserver
50	```
51
52	### Image Management
53
54	```bash
55	# Pull image
56	podman pull docker.io/library/nginx:latest
57
58	# List images
59	podman images
60
61	# Build image
62	podman build -t myapp:latest .
63
64	# Push to registry
65	podman push myapp:latest registry.example.com/myapp:latest
66
67	# Remove image
68	podman rmi nginx:latest
69	```
70
71	## Rootless Containers
72
73	### Setup
74
75	```bash
76	# Check user namespace support
77	cat /proc/sys/user/max_user_namespaces
78
79	# Enable if needed (as root)
80	echo "user.max_user_namespaces=28633" \| sudo tee /etc/sysctl.d/userns.conf
81	sudo sysctl -p /etc/sysctl.d/userns.conf
82
83	# Configure subuid/subgid for user
84	sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER
85
86	# Verify
87	podman unshare cat /proc/self/uid_map
88	```
89
90	### Running Rootless
91
92	```bash
93	# Run as regular user (no sudo)
94	podman run -d --name myapp -p 8080:80 nginx
95
96	# Check user namespace mapping
97	podman unshare id
98
99	# Verify non-root
100	podman top myapp user
101	```
102
103	### Port Considerations
104
105	```bash
106	# Rootless cannot bind to ports < 1024 by default
107	# Use ports >= 1024
108	podman run -d -p 8080:80 nginx
109
110	# Or enable unprivileged ports (as root)
111	echo "net.ipv4.ip_unprivileged_port_start=80" \| sudo tee /etc/sysctl.d/ports.conf
112	sudo sysctl -p /etc/sysctl.d/ports.conf
113	```
114
115	## Pods
116
117	### Creating Pods
118
119	```bash
120	# Create pod
121	podman pod create --name mypod -p 8080:80 -p 5432:5432
122
123	# Add containers to pod
124	podman run -d --pod mypod --name web nginx
125	podman run -d --pod mypod --name db postgres:15
126
127	# List pods
128	podman pod ps
129
130	# Containers share network namespace
131	podman exec web curl localhost:5432
132	```
133
134	### Pod Management
135
136	```bash
137	# Start/stop pod (affects all containers)
138	podman pod start mypod
139	podman pod stop mypod
140
141	# Remove pod and containers
142	podman pod rm -f mypod
143
144	# View pod details
145	podman pod inspect mypod
146
147	# Generate Kubernetes YAML from pod
148	podman generate kube mypod > mypod.yaml
149	```
150
151	## Systemd Integration
152
153	### Generate Systemd Unit
154
155	```bash
156	# Generate unit file for container
157	podman generate systemd --new --name myapp > ~/.config/systemd/user/container-myapp.service
158
159	# For pod
160	podman generate systemd --new --name mypod --files
161
162	# Reload systemd
163	systemctl --user daemon-reload
164
165	# Enable and start
166	systemctl --user enable --now container-myapp.service
167	```
168
169	### Quadlet (Podman 4.4+)
170
171	```ini
172	# ~/.config/containers/systemd/webapp.container
173	[Container]
174	Image=docker.io/library/nginx:latest
175	PublishPort=8080:80
176	Volume=webapp-data:/usr/share/nginx/html
177
178	[Service]
179	Restart=always
180
181	[Install]
182	WantedBy=default.target
183	```
184
185	```bash
186	# Reload to generate service
187	systemctl --user daemon-reload
188
189	# Start the service
190	systemctl --user start webapp
191	```
192
193	## Compose Compatibility
194
195	### Using Podman Compose
196
197	```bash
198	# Install podman-compose
199	pip install podman-compose
200
201	# Run compose file
202	podman-compose up -d
203
204	# Or use Docker Compose with Podman socket
205	systemctl --user enable --now podman.socket
206	export DOCKER_HOST=unix:///run/user/$UID/podman/podman.sock
207	docker-compose up -d
208	```
209
210	### Native Podman Kube
211
212	```bash
213	# Play Kubernetes YAML
214	podman kube play deployment.yaml
215
216	# Stop and remove
217	podman kube down deployment.yaml
218	```
219
220	## Networking
221
222	### Network Management
223
224	```bash
225	# Create network
226	podman network create mynetwork
227
228	# Run on network
229	podman run -d --network mynetwork --name app myapp
230
231	# Connect container to network
232	podman network connect mynetwork existing-container
233
234	# List networks
235	podman network ls
236
237	# Inspect network
238	podman network inspect mynetwork
239	```
240
241	### DNS Resolution
242
243	```bash
244	# Containers on same network can resolve by name
245	podman run -d --network mynetwork --name db postg

People who liked this also viewed

6 picks

Type

podman

42stars4forks

View on GitHub

How to install podman?

bagelhole/devops-security-agent-skills/podman

$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill podman

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Podman
2
3	Run and manage containers without a daemon using Podman's rootless container engine.
4
5	## When to Use This Skill
6
7	Use this skill when:
8	- Running containers without root privileges
9	- Managing containers on systems without Docker
10	- Creating pod-based container groups
11	- Using systemd for container management
12	- Working in security-conscious environments
13
14	## Prerequisites
15
16	- Podman installed (4.x+)
17	- For rootless: user namespaces enabled
18	- Basic container concepts understanding
19
20	## Key Differences from Docker
21
22	\| Feature \| Docker \| Podman \|
23	\|---------\|--------\|--------\|
24	\| Architecture \| Client-daemon \| Daemonless \|
25	\| Root required \| Default \| Optional (rootless) \|
26	\| Pod support \| No \| Yes (Kubernetes-style) \|
27	\| Systemd integration \| Limited \| Native \|
28	\| Socket \| docker.sock \| podman.sock (optional) \|
29
30	## Basic Commands
31
32	### Container Operations
33
34	```bash
35	# Run container (identical to Docker)
36	podman run -d --name webserver -p 8080:80 nginx
37
38	# List containers
39	podman ps -a
40
41	# Stop and remove
42	podman stop webserver
43	podman rm webserver
44
45	# Execute command
46	podman exec -it webserver /bin/sh
47
48	# View logs
49	podman logs -f webserver
50	```
51
52	### Image Management
53
54	```bash
55	# Pull image
56	podman pull docker.io/library/nginx:latest
57
58	# List images
59	podman images
60
61	# Build image
62	podman build -t myapp:latest .
63
64	# Push to registry
65	podman push myapp:latest registry.example.com/myapp:latest
66
67	# Remove image
68	podman rmi nginx:latest
69	```
70
71	## Rootless Containers
72
73	### Setup
74
75	```bash
76	# Check user namespace support
77	cat /proc/sys/user/max_user_namespaces
78
79	# Enable if needed (as root)
80	echo "user.max_user_namespaces=28633" \| sudo tee /etc/sysctl.d/userns.conf
81	sudo sysctl -p /etc/sysctl.d/userns.conf
82
83	# Configure subuid/subgid for user
84	sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 $USER
85
86	# Verify
87	podman unshare cat /proc/self/uid_map
88	```
89
90	### Running Rootless
91
92	```bash
93	# Run as regular user (no sudo)
94	podman run -d --name myapp -p 8080:80 nginx
95
96	# Check user namespace mapping
97	podman unshare id
98
99	# Verify non-root
100	podman top myapp user
101	```
102
103	### Port Considerations
104
105	```bash
106	# Rootless cannot bind to ports < 1024 by default
107	# Use ports >= 1024
108	podman run -d -p 8080:80 nginx
109
110	# Or enable unprivileged ports (as root)
111	echo "net.ipv4.ip_unprivileged_port_start=80" \| sudo tee /etc/sysctl.d/ports.conf
112	sudo sysctl -p /etc/sysctl.d/ports.conf
113	```
114
115	## Pods
116
117	### Creating Pods
118
119	```bash
120	# Create pod
121	podman pod create --name mypod -p 8080:80 -p 5432:5432
122
123	# Add containers to pod
124	podman run -d --pod mypod --name web nginx
125	podman run -d --pod mypod --name db postgres:15
126
127	# List pods
128	podman pod ps
129
130	# Containers share network namespace
131	podman exec web curl localhost:5432
132	```
133
134	### Pod Management
135
136	```bash
137	# Start/stop pod (affects all containers)
138	podman pod start mypod
139	podman pod stop mypod
140
141	# Remove pod and containers
142	podman pod rm -f mypod
143
144	# View pod details
145	podman pod inspect mypod
146
147	# Generate Kubernetes YAML from pod
148	podman generate kube mypod > mypod.yaml
149	```
150
151	## Systemd Integration
152
153	### Generate Systemd Unit
154
155	```bash
156	# Generate unit file for container
157	podman generate systemd --new --name myapp > ~/.config/systemd/user/container-myapp.service
158
159	# For pod
160	podman generate systemd --new --name mypod --files
161
162	# Reload systemd
163	systemctl --user daemon-reload
164
165	# Enable and start
166	systemctl --user enable --now container-myapp.service
167	```
168
169	### Quadlet (Podman 4.4+)
170
171	```ini
172	# ~/.config/containers/systemd/webapp.container
173	[Container]
174	Image=docker.io/library/nginx:latest
175	PublishPort=8080:80
176	Volume=webapp-data:/usr/share/nginx/html
177
178	[Service]
179	Restart=always
180
181	[Install]
182	WantedBy=default.target
183	```
184
185	```bash
186	# Reload to generate service
187	systemctl --user daemon-reload
188
189	# Start the service
190	systemctl --user start webapp
191	```
192
193	## Compose Compatibility
194
195	### Using Podman Compose
196
197	```bash
198	# Install podman-compose
199	pip install podman-compose
200
201	# Run compose file
202	podman-compose up -d
203
204	# Or use Docker Compose with Podman socket
205	systemctl --user enable --now podman.socket
206	export DOCKER_HOST=unix:///run/user/$UID/podman/podman.sock
207	docker-compose up -d
208	```
209
210	### Native Podman Kube
211
212	```bash
213	# Play Kubernetes YAML
214	podman kube play deployment.yaml
215
216	# Stop and remove
217	podman kube down deployment.yaml
218	```
219
220	## Networking
221
222	### Network Management
223
224	```bash
225	# Create network
226	podman network create mynetwork
227
228	# Run on network
229	podman run -d --network mynetwork --name app myapp
230
231	# Connect container to network
232	podman network connect mynetwork existing-container
233
234	# List networks
235	podman network ls
236
237	# Inspect network
238	podman network inspect mynetwork
239	```
240
241	### DNS Resolution
242
243	```bash
244	# Containers on same network can resolve by name
245	podman run -d --network mynetwork --name db postg

People who liked this also viewed

6 picks

Type