🦭 Podman Containers Deep Dive

RHCSA RHEL 10 — Images · Containers · Volumes · Rootless · Pods · Registry · Production

DaemonlessRootless OCI CompliantDocker Compatible 19 Topics · L1→L3

🦭

1. Podman Overview (L1)

Daemonless · Rootless · OCI · Docker-compatible container engine for RHEL 8/9/10

L1-01

What is Podman? Architecture vs Docker

Podman (Pod Manager) is a daemonless, rootless, OCI-compliant container engine — the default on RHEL 8/9/10.

Feature	Docker	Podman
Architecture	Client-server — dockerd daemon required	Daemonless — fork/exec per command via conmon
Root requirement	Root or docker group required	Fully rootless — user namespace mapping
Security	Single root daemon = single attack point	No persistent daemon — no root process to exploit
CLI	docker CLI	podman CLI — drop-in compatible
Pods	Compose only	Native pod support (Kubernetes-compatible)
Systemd	Limited	Native — Quadlet unit files on RHEL 10
K8s migration	docker-compose limited	podman generate kube → valid K8s YAML
OCI	Yes	Yes — OCI native

Daemonless means: if podman CLI crashes, running containers are NOT affected — no parent daemon to kill them. Docker containers die if dockerd crashes.

Core commands

podman --version # version check podman info # full system info (storage, registries, cgroup) podman info | grep -i rootless # confirm rootless capability podman info | grep cgroupVersion # must be v2 for rootless resource limits

📦

2. Image Management (L1)

Pull · Build · List · Search · Tag · Remove · Containerfile

L1-02

Image Management — Pull, Build, List, Remove

Pull Images

podman pull nginx:latest podman pull docker.io/library/httpd:2.4 podman pull registry.redhat.io/ubi9/ubi:latest # Red Hat UBI podman pull quay.io/prometheus/prometheus:latest # Quay.io

List Images

podman images podman images -a # include intermediate layers podman images --format "table {{.Repository}}\t{{.Tag}}\t{{.Size}}" podman images --filter dangling=true # untagged images

Search Images

podman search nginx podman search --limit 5 nginx podman search registry.redhat.io/

Remove Images

podman rmi nginx:latest podman rmi -f nginx:latest # force (even if containers use it) podman image prune # remove dangling images podman image prune -a # remove ALL unused images

Build Images (Containerfile)

# Containerfile FROM registry.redhat.io/ubi9/ubi-minimal:latest RUN microdnf install -y nginx && microdnf clean all COPY html/ /usr/share/nginx/html/ EXPOSE 80 USER nginx CMD ["nginx", "-g", "daemon off;"] podman build -t myapp:v1 . podman build --no-cache -t myapp:v1 . # fresh build podman build --squash -t myapp:v1 . # squash all layers

★ PRO TIP: Use ubi9-minimal as base on RHEL — Red Hat supported, smaller than full RHEL, freely redistributable. Use ubi-init when systemd inside the container is needed.

♻️

3. Container Lifecycle (L1)

run · start · stop · restart · kill · rm — full lifecycle with all key options

L1-03

Container Lifecycle — Full Reference

Run Container

podman run nginx # foreground podman run -d nginx # detached (background) podman run -d --name web nginx # named container podman run -it --name shell ubi9 /bin/bash # interactive terminal podman run --rm nginx # auto-remove on exit podman run -d -e MYSQL_ROOT_PASSWORD=secret mariadb podman run -d --memory 512m --cpus 1.5 nginx # resource limits podman run -d --restart=always --name web nginx # auto-restart

List / Start / Stop / Remove

podman ps # running containers podman ps -a # all (including stopped) podman ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}" podman start web && podman stop web && podman restart web podman kill -s SIGHUP web # send signal (e.g. nginx reload) podman rm web && podman rm -f web # remove (force) podman container prune # remove all stopped

Option	Description	Example
-d	Detached mode	`-d`
-it	Interactive terminal	`-it ubi9 bash`
--name	Name the container	`--name webserver`
-p	Port mapping host:container	`-p 8080:80`
-v	Volume / bind mount	`-v mydata:/app/data`
-e	Environment variable	`-e DB_HOST=localhost`
--rm	Auto-remove on exit	`--rm`
--read-only	Read-only root filesystem	`--read-only`
--cap-drop	Drop Linux capabilities	`--cap-drop ALL`
--security-opt	Security options	`--security-opt no-new-privileges`
--restart	Restart policy	`--restart always`

🔗

4. Container Interaction (L1)

exec · logs · inspect · top · stats · cp — interact with running containers

L1-04

Container Interaction — exec, logs, inspect, stats

Exec into Container

podman exec -it web /bin/bash # interactive shell podman exec web cat /etc/nginx/nginx.conf # single command podman exec -u root web ps aux # as specific user

Logs

podman logs web # all logs podman logs -f web # follow (tail -f) podman logs --tail 50 web # last 50 lines podman logs --since 1h web # last 1 hour podman logs --timestamps web # with timestamps

Inspect

podman inspect web # full JSON metadata podman inspect --format "{{.State.Status}}" web podman inspect --format "{{.NetworkSettings.IPAddress}}" web podman inspect --format "{{.HostConfig.Binds}}" web podman inspect --format "{{.Config.Env}}" web

Stats & Top

podman top web # processes in container podman stats web # live CPU/mem/IO podman stats --no-stream # one-shot snapshot

Copy Files

podman cp web:/etc/nginx/nginx.conf ./ # FROM container podman cp ./config.conf web:/etc/nginx/ # TO container

🌐

5. Container Ports & Networking (L1)

Port mapping · Network create · Container DNS · Custom networks

L1-05

Container Ports & Networking

Port Mapping

podman run -d --name web -p 8080:80 nginx # host:container podman run -d --name web -p 127.0.0.1:8080:80 nginx # bind to specific IP podman run -d -P nginx # auto-map all EXPOSE ports podman port web # show mappings

Network Management

podman network ls # list networks podman network create mynet # create bridge network podman network create --subnet 192.168.100.0/24 mynet podman network inspect mynet podman network connect mynet web # connect running container podman network disconnect mynet web podman network rm mynet && podman network prune

Run Container in Network

podman run -d --name app --network mynet nginx # Containers in same custom network resolve each other by name podman run -d --name db --network appnet postgres:15 podman run -d --name app --network appnet myapp # Inside app: curl http://db:5432 resolves automatically

DNS resolution: containers on the default bridge CANNOT resolve each other by name. Create a custom network (podman network create mynet) for container-to-container DNS.

💾

6. Volumes Management (L1)

Named volumes · Create · Inspect · Mount · Backup · Restore

L1-06

Volumes Management

Create & Use Named Volumes

podman volume create mydata podman volume ls podman volume inspect mydata # find host mount path podman run -d --name db -v mydata:/var/lib/mysql docker.io/mariadb:latest podman run -d --name db -v mydata:/var/lib/mysql:ro nginx # read-only podman volume rm mydata && podman volume prune # cleanup

Aspect	Named Volume	Bind Mount
Managed by	Podman	User (host filesystem)
Location	Container storage dir	Any host path
SELinux	Auto-labelled	Needs :Z or :z suffix
Use case	Database data, persistent state	Config files, source code
Syntax	`-v volname:/path`	`-v /host/path:/path`

Volume Backup & Restore

podman volume export mydata -o mydata.tar podman volume import mydata mydata.tar

📂

7. Bind Mounts (L1)

Host path mounting · SELinux :Z :z labels · Read-only mounts · RHEL SELinux context

L1-07

Bind Mounts & SELinux Labels

Bind Mount Syntax

podman run -d --name app \ -v /opt/appdata:/usr/share/nginx/html:Z nginx podman run -d --name app \ -v /etc/hosts:/mnt/hosts:ro alpine

Label	Meaning	When to Use
:Z	Private — relabel for this container ONLY	Single container accessing the path
:z	Shared — relabel for multiple containers	Multiple containers sharing same host path
:ro	Read-only	Container must not modify host files
:Z,ro	Private + read-only	Config files for single container

Always add :Z on RHEL with SELinux enforcing. Without it, even if filesystem permissions are correct, the container gets Permission denied because SELinux blocks the access. Check: ausearch -m avc -ts recent

🫛

8. Pods (L2)

Create pods · Add containers · K8s YAML export · Infra container

L2-08

Pods — Kubernetes-style Container Groups

A Pod groups containers sharing the same network namespace, IPC, and optionally PID namespace — identical to Kubernetes pods. Port mappings go on the pod, not containers.

Pod Lifecycle

podman pod create --name mypod -p 8080:80 podman pod ps podman pod inspect mypod podman pod start mypod && podman pod stop mypod && podman pod restart mypod podman pod kill mypod && podman pod rm -f mypod

Add Containers to Pod

podman run -d --pod mypod --name c1 nginx podman run -d --pod mypod --name c2 busybox sleep 3600 podman ps --pod # show pod column

Kubernetes YAML — migrate to K8s

podman generate kube mypod > mypod.yaml podman generate kube mypod --service > mypod-svc.yaml # Re-create from YAML (on another Podman host) podman play kube mypod.yaml podman play kube --down mypod.yaml # tear down

Infra container: every pod has a hidden pause infra container that holds the network namespace. Inspect: podman ps -a --pod | grep infra

🔐

9. Rootless Containers (L2)

User namespaces · subuid/subgid · Systemd integration · Quadlet (RHEL 10)

L2-09

Rootless Containers — Architecture & Setup

No root process — container UID 0 maps to your unprivileged host UID via user namespaces
No persistent daemon — completely eliminates the dockerd root attack surface
CI/CD safety — build/run containers in pipelines without giving root to CI agents
Multi-user — each user has isolated, invisible container namespaces

Setup & Verify Rootless

cat /etc/subuid # username:100000:65536 (required for user namespaces) cat /etc/subgid # If missing, configure: usermod --add-subuids 100000-165535 username usermod --add-subgids 100000-165535 username podman system migrate # Run rootless — no sudo! podman run -d --name rootless-nginx nginx podman info | grep -i rootless

Rootless + Systemd (auto-start on login)

podman generate systemd --name rootless-nginx > ~/.config/systemd/user/container-nginx.service systemctl --user daemon-reload systemctl --user enable --now container-nginx loginctl enable-linger $USER # keep running after logout systemctl --user status container-nginx

Quadlet — RHEL 10 native systemd approach

# Create: ~/.config/containers/systemd/web.container [Unit] Description=Nginx Web Container [Container] Image=nginx:latest PublishPort=8080:80 [Service] Restart=always [Install] WantedBy=default.target systemctl --user daemon-reload systemctl --user start web

🏪

10. Registry Operations (L2)

L2-10

Registry Operations

podman login registry.redhat.io podman login -u user -p pass registry.example.com podman login --authfile /tmp/auth.json registry.example.com # non-interactive CI podman tag myapp:latest registry.example.com/myimage:latest podman push registry.example.com/myimage:latest podman pull registry.example.com/myimage:latest podman logout registry.redhat.io podman logout --all

Registry config — /etc/containers/registries.conf

[registries.search] registries = ['registry.redhat.io', 'quay.io', 'docker.io'] [registries.insecure] registries = ['internal.example.com:5000']

Skopeo — inspect/copy without pulling

skopeo inspect docker://nginx:latest | jq .Labels skopeo copy docker://nginx:latest docker://registry.example.com/nginx:latest

💿

11. Container Commit & Export (L2)

commit · save · load · export · import — image portability and backup

L2-11

Container Commit & Export

Commit Container → Image

podman commit web myweb:latest podman commit --message "Config added" web myweb:v2

Save & Load (image tar — preferred for offline transfer)

podman save -o myweb.tar myweb:latest podman load -i myweb.tar

Export & Import (filesystem only — no image metadata)

podman export web -o web-fs.tar podman import web-fs.tar myweb:imported

Operation	Includes	Use Case
`podman save`	Image layers + metadata	Offline image transfer between hosts
`podman export`	Container filesystem only (flat)	Snapshot container filesystem
`podman commit`	Running container → new image	Capture configured container
`podman push`	Push to registry	Best practice for image sharing

🐋

12. Docker Compatibility (L2)

Alias · Socket emulation · podman-compose · Docker → Podman migration

L2-12

Docker Compatibility

alias docker=podman # in ~/.bashrc sudo ln -s $(which podman) /usr/local/bin/docker # system-wide symlink # Verify — these now run podman docker ps && docker images && docker run -d nginx

Docker Socket emulation (for apps needing docker.sock)

dnf install podman-docker systemctl --user start podman.socket systemctl --user enable podman.socket DOCKER_HOST=unix:///run/user/$(id -u)/podman/podman.sock docker ps

Docker	Podman	Notes
docker run	podman run	Identical syntax
docker-compose up	podman-compose up	Requires podman-compose
docker swarm	podman play kube	Use Kubernetes for orchestration
docker build	podman build	Containerfile or Dockerfile

🔧

13. Troubleshooting (L2)

Common issues · Diagnosis commands · SELinux · Rootless · Storage

L2-13

Troubleshooting — Issues, Diagnosis & Solutions

Issue	Diagnosis	Solution
Container not starting	`podman logs <c>` `podman inspect <c>`	Check exit code + logs. Verify CMD exists in image.
Port already in use	`ss -tulnp \| grep <port>`	Kill conflicting process or use different host port.
Image pull failed	`podman pull <image> 2>&1`	Check internet/DNS, verify registry login.
Permission denied (rootless)	`cat /etc/subuid`	Add subuid/subgid entries + `podman system migrate`
Storage full	`podman system df`	`podman system prune -a`
Container exits immediately	`podman ps -a` `podman logs <id>`	PID1 must not exit. Debug: `podman run --entrypoint bash myimage`
SELinux permission denied	`ausearch -m avc -ts recent`	Add :Z to mount: `-v /path:/cpath:Z`
DNS not resolving	`podman exec web cat /etc/resolv.conf`	Create custom network: `podman network create`
Volume mount empty	`podman inspect web \| grep Mounts`	Check host path exists, SELinux label, volume name.
OCI runtime error	`podman run ... 2>&1`	Check crun: `rpm -q crun`

Advanced diagnostics

podman events --since 1h # all events last hour podman --log-level debug run nginx 2>&1 # verbose debug output podman system df # disk usage breakdown podman system reset # nuclear option — removes everything

⚙️

14. System Management (L2)

prune · stats · info · version · systemd units · Quadlet (RHEL 10)

L2-14

System Management

Disk Usage & Prune

podman system df # disk usage by category podman system df -v # verbose breakdown podman system prune # stopped containers + dangling images podman system prune -a # + all unused images podman system prune --volumes # + unused volumes (careful!) podman container prune # stopped containers only podman image prune -a # unused images only podman volume prune # unused volumes only

System Info & Version

podman info # full system config podman info | grep -A5 "store" # storage config podman info | grep cgroupVersion # cgroup v1 or v2 podman --version && podman version # version details

🏭

15. Real Production Scenarios (L3)

Application isolation · CI/CD pipelines · Security hardening · Disaster recovery

🔴 Scenario: Application Isolation — Multi-tier App

Deploy frontend (Nginx), backend API (Flask), and database (PostgreSQL) on RHEL 10. Each tier isolated, only frontend port exposed externally.

Probe Questions

How do you design the network topology?
How do you handle DB persistence?
How do you auto-restart on failure?

Strong Candidate Demonstrates

Creates frontend-net (nginx+api) and backend-net (api+db). Only API connects to both — database has no external port mapping.
Named volume for PostgreSQL: podman volume create pgdata
Systemd unit files or Quadlet for auto-restart. Uses --restart=always.
Generates K8s YAML with podman generate kube for documentation.

🔴 Scenario: CI/CD Pipeline — Rootless Build & Push

Jenkins/GitLab CI runner on shared RHEL 10 — build images, test in containers, push to registry — no root access on runner.

Probe Questions

How do you configure rootless Podman in CI?
How do you authenticate non-interactively?
How do you cache layers between runs?

Strong Candidate Demonstrates

Rootless Podman: no sudo, no docker group, no root daemon.
Auth via file: podman login --authfile /tmp/auth.json registry.example.com. Credentials as CI secret.
Build args from env: podman build --build-arg VERSION=$CI_SHA -t myapp .
Pre-pull base image to seed layer cache: podman pull myapp:latest before build.

🔴 Scenario: Security Hardening — Minimal Attack Surface

Production nginx container: no new privileges, read-only filesystem, dropped capabilities, non-root user, SELinux enforcing.

Probe Questions

What flags enforce these requirements?
How does nginx write pid/tmp files if root filesystem is read-only?

Strong Candidate Demonstrates

podman run -d --read-only --security-opt no-new-privileges --cap-drop ALL --cap-add NET_BIND_SERVICE --user 1001:1001 nginx
Tmpfs for required write paths: --tmpfs /var/run --tmpfs /var/cache/nginx --tmpfs /tmp
Verify: podman inspect --format "{{.HostConfig.ReadonlyRootfs}}" web
Verify user: podman exec web id — should show UID 1001, NOT root.

🔴 Scenario: Disaster Recovery — Air-gapped Image Migration

6 production containers on RHEL 10 must migrate to new hardware. No registry available (air-gapped environment). Minimal downtime.

Probe Questions

How do you capture container configurations?
How do you transfer images without a registry?
How do you preserve volume data?

Strong Candidate Demonstrates

Save all images: for img in $(podman images -q); do podman save -o images/$img.tar $img; done
Export volumes: podman volume export volname -o volname.tar
Transfer via SCP/rsync. Import on new host: podman load -i image.tar, podman volume import volname volname.tar
Verify: podman ps, podman stats --no-stream, application health checks.

📊

L1 → L3 Responsibility Matrix

Competency breakdown: Basic · Intermediate · Advanced

MATRIX

L1 → L3 Responsibility Matrix

Level	Focus	Responsibilities	Key Commands
L1 Basic	Container Basics	Run containers, manage images, volumes & basic troubleshooting	`run, ps, images, rmi, logs, exec`
L2 Intermediate	Container Management	Networks, volumes, pods, registry, rootless, commit/export	`network, volume, pod, commit, login, info`
L3 Advanced	Production Admin	Design, secure, optimise, troubleshoot & automate	`inspect, system df, prune, generate kube, events`

L1 Must Know

Run named container detached
List/start/stop/remove containers
Pull and remove images
View logs
Map ports
Create/mount named volumes
Bind mounts with :Z

L2 Must Know

Custom networks + DNS
Build from Containerfile
Rootless configuration
Registry login/push
Create and manage pods
Generate systemd units
Commit containers to images

L3 Must Know

Multi-tier container architecture
Security hardening flags
K8s YAML generation
CI/CD rootless integration
Disaster recovery image save/load
Quadlet systemd (RHEL 10)
Performance tune + resource limits

🎯

Interview Questions — L2/L3

8 core interview questions with comprehensive model answers

IQ-01

Interview Q&A — 8 Core Questions with Model Answers

Q1. What is Podman and how is it different from Docker?

▸ ANSWERPodman is a daemonless, rootless, OCI-compliant container engine. Key differences: (1) No persistent daemon — Docker requires dockerd as root; Podman uses fork/exec with conmon per container. (2) Rootless by default — user namespace maps container root to unprivileged host UID. (3) No single point of failure — containers survive if podman CLI crashes. (4) Native pod support matching Kubernetes semantics. (5) Generates valid K8s YAML natively.

Q2. How do you run a container in detached mode?

▸ ANSWERpodman run -d --name web nginx — -d detaches from terminal. Container runs in background. View output: podman logs web. Attach: podman attach web. Container's PID 1 must be a long-running process — if it exits, the container stops.

Q3. How do you map a host port to a container port?

▸ ANSWERpodman run -d -p 8080:80 nginx — format: -p HOST_PORT:CONTAINER_PORT. Traffic to localhost:8080 → container port 80. Bind to specific IP: -p 127.0.0.1:8080:80. Rootless: ports below 1024 need net.ipv4.ip_unprivileged_port_start sysctl.

Q4. What is a pod in Podman?

▸ ANSWERA pod groups containers sharing the same network namespace, IPC namespace — identical to Kubernetes pods. All containers share one IP, communicate via localhost. Port mappings are at pod level. Create: podman pod create --name mypod -p 8080:80. Add containers: podman run -d --pod mypod --name c1 nginx. Export to K8s: podman generate kube mypod.

Q5. How do you create and use volumes?

▸ ANSWERpodman volume create mydata — Podman-managed storage. Mount: podman run -d -v mydata:/var/lib/mysql mariadb. Persists beyond container removal. Inspect mount path: podman volume inspect mydata. Backup: podman volume export mydata -o backup.tar. Rootless storage: $HOME/.local/share/containers/storage/volumes/.

Q6. How do rootless containers work?

▸ ANSWERUses Linux user namespaces — UID 0 inside container maps to your unprivileged host UID. Configured via /etc/subuid and /etc/subgid. Networking uses slirp4netns or pasta (RHEL 10) — userspace TCP/IP, no iptables root required. Cgroup v2 required for resource limits. Verify: podman info | grep rootless.

Q7. How do you troubleshoot a failed container?

▸ ANSWERStep 1: podman ps -a — find exited container, note exit code. Step 2: podman logs <container> — read application error. Step 3: podman inspect <container> — check config, mounts, network. Step 4: podman events --since 1h — runtime events. Step 5: SELinux check: ausearch -m avc + add :Z. Step 6: Debug interactively: podman run --entrypoint /bin/sh myimage.

Q8. How do you save and load a container image?

▸ ANSWERSave: podman save -o myimage.tar myimage:latest — exports all layers + metadata. Load: podman load -i myimage.tar. Air-gap workflow: save → SCP → load on target host. Alternative: podman export/import for filesystem-only snapshot (no image metadata). Best practice: use a registry with push/pull when possible.

🔬

Deep-Dive Topics

cgroups v2 · Linux namespaces · Image layers · Storage drivers · Optimisation

DD-01

Deep Dive — cgroups v2, Namespaces & Layers

cgroups v2 — Resource enforcement

podman run -d --cpus 1.5 nginx # 1.5 CPU limit podman run -d --memory 512m nginx # 512 MB RAM podman run -d --memory-swap 1g nginx # RAM + swap = 1GB podman run -d --cpuset-cpus 0,1 nginx # pin to cores 0 and 1 podman stats --no-stream --format json # resource snapshot

Namespace	Isolates	Podman Usage
PID	Process tree starting at PID 1	Each container gets own PID namespace
Network	Interfaces, routing	Each container gets veth pair + bridge
Mount	Filesystem view	Container / = image layers (overlay)
IPC	SysV IPC, message queues	Isolated by default; shared in pods
UTS	Hostname	Container has own hostname
User	UID/GID mapping	Rootless maps UID 0 → host UID
Cgroup	Cgroup tree visibility	Container sees only its cgroup slice

Image layer inspection

podman history nginx:latest # show all layers + sizes podman history --no-trunc nginx:latest # full commands podman info | grep graphDriver # storage driver (overlay on RHEL) # Layer cache optimisation in Containerfile: # BAD — invalidates cache every build: COPY . /app RUN pip install -r /app/requirements.txt # GOOD — stable layer first: COPY requirements.txt /app/ RUN pip install -r /app/requirements.txt # cached COPY . /app # only rebuilds when src changes

📋

Quick Reference Cheat Sheet

40 essential Podman commands organised by category — L1 to L3

REF

Quick Reference Cheat Sheet — All Essential Commands

Category	Command	Description
Container	`podman run -d --name web nginx`	Run detached named container
Container	`podman run -it ubi9 bash`	Interactive shell
Container	`podman run --rm alpine date`	Run & auto-remove
Container	`podman ps -a`	List all containers
Container	`podman stop/start/restart web`	Lifecycle control
Container	`podman rm -f web`	Force remove
Container	`podman container prune`	Remove all stopped
Image	`podman pull nginx:latest`	Pull image
Image	`podman images`	List images
Image	`podman rmi nginx:latest`	Remove image
Image	`podman image prune -a`	Remove all unused
Image	`podman build -t myapp:v1 .`	Build from Containerfile
Image	`podman save -o img.tar myapp:v1`	Export to tar
Image	`podman load -i img.tar`	Import from tar
Interact	`podman exec -it web bash`	Shell into container
Interact	`podman logs -f web`	Follow logs
Interact	`podman inspect web`	Full metadata JSON
Interact	`podman stats`	Live resource usage
Interact	`podman cp web:/etc/nginx.conf .`	Copy from container
Network	`podman network create mynet`	Create bridge network
Network	`podman network ls`	List networks
Network	`podman port web`	Show port mappings
Volume	`podman volume create mydata`	Create volume
Volume	`podman volume ls/inspect/rm`	Manage volumes
Volume	`podman volume export/import`	Backup/restore
Pod	`podman pod create --name mypod -p 8080:80`	Create pod
Pod	`podman pod ps`	List pods
Pod	`podman generate kube mypod`	Export to K8s YAML
Pod	`podman play kube mypod.yaml`	Create from K8s YAML
Registry	`podman login registry.redhat.io`	Login to registry
Registry	`podman push myapp:v1 registry.example.com/myapp:v1`	Push image
System	`podman system df`	Disk usage
System	`podman system prune -a`	Remove all unused
System	`podman info`	System config
System	`podman events --since 1h`	Recent events
Security	`podman run --read-only --security-opt no-new-privileges --cap-drop ALL`	Hardened run
Rootless	`cat /etc/subuid && cat /etc/subgid`	Check user namespace config
Rootless	`podman system migrate`	Apply rootless configuration
Systemd	`podman generate systemd --name web`	Generate unit file
Docker	`alias docker=podman`	Docker compatibility alias