Podman is a container engine developed by Red Hat that runs the same OCI images as Docker, with a nearly identical command line — many people simply alias docker=podman. The differences are in architecture, and they matter for security and how containers integrate with the host.

Architecture

Docker runs a central daemon (dockerd) as root. The docker CLI sends requests to it; the daemon starts and supervises all containers.

Podman is daemonless: each podman command starts containers directly as child processes (via conmon and the OCI runtime). There’s no always-running root service.

Consequences:

  • No single root daemon to attack or crash.
  • Containers started by a user belong to that user — natural rootless operation.
  • Without a daemon, something else must restart containers at boot: Podman integrates with systemd for that.

Comparison

Docker Podman
Daemon Yes (dockerd, root) No
Rootless Supported (extra setup) Default design
CLI docker podman (largely compatible)
Images OCI / Docker Hub Same images, any registry
Compose Docker Compose v2 podman compose (wraps a Compose provider), or Docker Compose against Podman’s socket
Pods No Yes — Kubernetes-style pods
Kubernetes YAML No podman kube play / generate kube
Boot integration Restart policies systemd units via Quadlet
Swarm Yes No
Default on Most distros via Docker’s repo RHEL, AlmaLinux, Rocky, Fedora
Docker Desktop equivalent Docker Desktop Podman Desktop

Rootless containers

With Podman, a normal user can run containers without any root privileges:

podman run -d --name web -p 8080:80 docker.io/library/nginx:stable

Inside the container, processes may run as “root”, but that maps to your unprivileged user on the host (user namespaces). A container escape gives the attacker only your user’s rights.

Limitations: binding ports below 1024 needs a sysctl tweak (net.ipv4.ip_unprivileged_port_start) or a reverse proxy on the host; networking is slightly slower in rootless mode; some storage and network features need extra configuration.

Docker can also run rootless, but it’s an add-on mode; for Podman it’s the starting point. Compare with the security implications of the docker group in Docker socket permissions.

Running containers at boot: Quadlet

Instead of restart policies, Podman uses systemd. Quadlet files describe containers declaratively:

# ~/.config/containers/systemd/web.container   (rootless)
# or /etc/containers/systemd/web.container    (system-wide)
[Container]
Image=docker.io/library/nginx:stable
PublishPort=8080:80
Volume=/srv/web:/usr/share/nginx/html:ro

[Service]
Restart=always

[Install]
WantedBy=default.target
systemctl --user daemon-reload
systemctl --user start web
loginctl enable-linger $USER      # keep user services running after logout

You get systemd’s dependency handling, logging (journalctl --user -u web) and restart logic. Auto-updates are available with podman auto-update.

Compose with Podman

Two options:

  • podman compose — calls an external Compose provider (docker-compose or podman-compose).
  • Run Podman’s Docker-compatible API socket (systemctl --user enable --now podman.socket) and point Docker Compose at it via DOCKER_HOST.

Most Compose files work; edge cases (some network modes, Swarm-only deploy: keys) may need adjustments.

Pods

Podman can group containers into a pod sharing a network namespace, like Kubernetes:

podman pod create --name app -p 8080:80
podman run -d --pod app --name web nginx:stable
podman run -d --pod app --name cache redis:7
podman generate kube app > app.yaml     # export as Kubernetes YAML

Handy for developing workloads that will later run on Kubernetes.

Which should you use?

Choose Docker if:

  • you rely on Docker Compose workflows, Docker Swarm, or tools that expect the Docker API;
  • your team and documentation are Docker-centric;
  • you want the most widely used, best-documented path.

Choose Podman if:

  • you run RHEL, AlmaLinux, Rocky or Fedora, where it’s the native, supported engine;
  • rootless containers and a smaller attack surface are priorities;
  • you like managing services with systemd.

Both run the same images, so switching later is mostly a matter of tooling.

Related: installing Podman, installing Docker on Ubuntu and rootless Docker. Either runs on any KVM VPS.

  • Podman
  • Docker
  • Containers