Podman is a container engine that builds and runs containers with a command-line interface nearly identical to Docker's - to the point that alias docker=podman works for most commands. Its two defining differences are that it is daemonless and runs rootless by default, which is why it's popular in security-conscious and CI environments and is the default container tool on Red Hat distributions.

Daemonless and rootless

Docker runs a central background daemon as root; every container is a child of that privileged process, which is a security and single-point-of-failure concern. Podman has no daemon - it launches containers as ordinary child processes of your shell, and can run them entirely as an unprivileged user. A compromised container in a rootless setup can't trivially escalate to root on the host. This model also fits CI pipelines and systemd, where a long-running root daemon is unwelcome.

# Same commands you already know
podman build -t myjob .
podman run --rm myjob
podman ps

# Generate a systemd unit to run a container as a managed service
podman generate systemd --new --name myjob > myjob.service

Pods and Kubernetes affinity

Podman borrows Kubernetes' pod concept - it can group containers into a pod locally, and podman generate kube / podman play kube convert between local pods and Kubernetes YAML. That makes it convenient for developing and testing workloads that will eventually run on Kubernetes.

Podman vs Docker

For everyday build-and-run the two are interchangeable, and both produce OCI-standard images that run anywhere. Choose Podman when you want rootless security, no daemon (cleaner in CI and on servers), or you're on RHEL/Fedora where it's the default. Docker remains more common for local development, has the larger ecosystem, and Docker Compose is more mature than Podman's compose support (though Podman now supports it). The image format is shared, so switching is low-risk.

Where it fits

  • CI/CD pipelines that shouldn't run a privileged daemon.
  • Security-sensitive hosts where rootless containers are required.
  • Red Hat / Fedora environments where Podman is the default toolchain.