Podman 5.3 failures in rootless networking and systemd integration

Podman 6.1.2 provides a daemonless architecture that consumes less memory than Docker across tested scenarios. While Docker 29.8.1 requires a root daemon to manage containers, Podman runs containers as user processes, which naturally reduces the attack surface. I find the transition from Docker to Podman on RHEL 8 or 9 easy because Podman remains the default engine on these systems. However, teams attempting to migrate complex workflows often hit walls when they realize Podman handles networking and service management through entirely different mechanisms.

If you are running rootless containers on a bridge network, you will encounter a long-standing limitation where containers cannot see the real source IP of incoming connections. The rootlessport userspace proxy rewrites the source to the container’s own subnet address, which breaks IP-based access control and logging. While the Pesto tool from the passt project now supports IPv6 port forwarding with source IP preservation, many users still struggle with permission denied errors when attempting to bind to ports below 1024. For example, a user running a pi-hole container on Podman 5.3.2 encountered a failure to create a listening socket for port 53. This error persists even when users attempt to use different network configurations or pod creations.

Quadlet and systemd management mistakes

Managing containers through systemd requires a shift in how you think about service lifecycles. Podman integrates with systemd via a generator that reads files with extensions like .container, .volume, and .network to produce service units. A common mistake involves ignoring the specific requirements of Quadlet units. Quadlet units do not support running as a non-root user by defining the User, Group, or DynamicUser options within the systemd file. To run a rootless Quadlet, you must place the file in the correct user directory, such as $HOME/.config/containers/systemd/, and manage it with systemctl –user.

The Podman 5.3 release notes reveal that a race condition could cause Quadlet to generate corrupt systemd units. This corruption makes troubleshooting difficult because the error might not appear until the generator runs. Additionally, the Quadlet generator failed to write error messages to STDERR, sending them to /dev/kmsg instead, which prevents errors from appearing during systemd-analyze –generators verify. If your container needs to pull an image at startup, the process might exceed the default 90 second systemd service startup limit. You must increase the TimeoutStartSec option in your Quadlet file to prevent these services from failing.

Teams often fail to realize that Podman services are transient. Systemd does not provide the same persistence rules for these generated units as it does for regular ones, so you cannot use systemctl enable to make them start on boot. The generator instead applies the [Install] section during the generation phase to mimic this behavior. If you attempt to use a container with a single-element command, the inspect command might include the command in both Path and Args, which differs from how Docker handles inspection.

Security and performance trade-offs

The decision between Docker and Podman involves a trade-off between developer velocity and security hardening. Docker provides a mature ecosystem with native first-party Compose support, whereas Podman relies on podman-compose for compatibility. Podman users can generate Kubernetes YAML using podman generate kube, but Docker requires external orchestration to interact with Kubernetes. Performance testing shows that Podman started small containers faster than Docker, while Docker performed better on larger containers. A study by arXiv measured Podman’s maximum overhead at 29% compared to 41% for Docker when measured against a bare-metal baseline.

Security remains the primary driver for Podman adoption in regulated industries like finance or healthcare. Podman launches each container with a Security-Enhanced Linux (SELinux) label, providing first-class volume labeling through :z and :Z flags. This differs from Docker, where SELinux support is an opt-in feature. However, recent security vulnerabilities highlight risks in the Podman ecosystem. CVE-2025-9566 allowed the podman kube play command to overwrite host files, and a separate issue involving checkpoint images showed that running images with certain annotations could disable all user-specified sandboxing. Because checkpoints ignore user-specified security configurations, developers must be careful when using them in production.

The cost difference between the two engines is stark for large organizations. Docker requires a paid subscription for commercial use in companies with more than 250 employees or $10M in annual revenue. A 200-developer organization using Docker Business would face a cost of roughly $57,600 a year before consumption add-ons. Podman has no per-seat license regardless of company size. Can organizations justify the higher Docker licensing fees when Podman provides native rootless security and no seat limits? Use Docker if you need mature CI/CD integrations and a broad ecosystem, but switch to Podman if your priority is reducing the attack surface through daemonless, rootless execution.