<![CDATA[Running Podman in production for years now, and I don't miss the Docker daemon one bit.]]>Running Podman in production for years now, and I don't miss the Docker daemon one bit.

I just published a deep dive on managing OCI containers the Unix way: daemonless, rootless, and natively integrated with systemd via Quadlets.

I cover:
- Real secrets management
- Auto-updates via systemd timers
- The Docker compatibility layer

This is the guide I wish I had when making the switch.

Read it here: https://blog.hofstede.it/podman-in-production-quadlets-secrets-auto-updates-and-docker-compatibility/

]]>https://forum.fedi.dk/topic/a01f41a9-c089-4a19-ae37-23f46e7b54bb/running-podman-in-production-for-years-now-and-i-don-t-miss-the-docker-daemon-one-bit.RSS for NodeFri, 17 Apr 2026 12:21:46 GMTSun, 05 Apr 2026 13:23:06 GMT60<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Thu, 09 Apr 2026 08:04:38 GMT]]>@Larvitz hi! Thanks for sharing. FYI in your article you use '’' (U+2019 "Right Single Quotation Mark") for apostrophes in e.g. »isn’t« and this confuses my screenreader (thankfully I am sighted).

]]>https://forum.fedi.dk/post/https://social.data.coop/users/reynir/statuses/116373709024053065https://forum.fedi.dk/post/https://social.data.coop/users/reynir/statuses/116373709024053065Thu, 09 Apr 2026 08:04:38 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Wed, 08 Apr 2026 22:32:03 GMT]]>@Larvitz great guide! I am not buying the recommendation on using Docker Desktop on Mac though. I have been using Podman Desktop for the last year and I just think it's great. I really have no reason to go back to Docker for this.

]]>https://forum.fedi.dk/post/https://hessen.social/users/morl99/statuses/116371457510550920https://forum.fedi.dk/post/https://hessen.social/users/morl99/statuses/116371457510550920Wed, 08 Apr 2026 22:32:03 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Tue, 07 Apr 2026 05:33:08 GMT]]>@Larvitz I have been running podman in production for years as well and I must say what an excellent documentation that is. I didn't know about quadlets but I will integrate it into my Ansible workflow for sure.

]]>https://forum.fedi.dk/post/https://chaos.social/users/Junicast/statuses/116361788681004003https://forum.fedi.dk/post/https://chaos.social/users/Junicast/statuses/116361788681004003Tue, 07 Apr 2026 05:33:08 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 19:27:11 GMT]]>@bexelbie The secrets (by default) are stored in json files under /var/lib/containers/storage/secrets .. Only protected by the file-system permissions. If you want them to be encrypted at rest, you could use something like OpenBao (OSS fork of Hashicorp Vault)

]]>https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116359405988608620https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116359405988608620Mon, 06 Apr 2026 19:27:11 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 19:17:48 GMT]]>@Larvitz I use podman for all my unorchestrated containers. Love it. How we I’ve stayed away from podman secrets as they used to be written to disk in plaintext. Did that get fixed?

]]>https://forum.fedi.dk/post/https://toot.io/users/bexelbie/statuses/116359369103510239https://forum.fedi.dk/post/https://toot.io/users/bexelbie/statuses/116359369103510239Mon, 06 Apr 2026 19:17:48 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 16:09:47 GMT]]>@svenhennessen awesome! I use it to run production workloads on my linux server (forgejo, Nextcloud, Keycloak etc.). Worked for the last 4 years without any issue.

]]>https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116358629771968338https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116358629771968338Mon, 06 Apr 2026 16:09:47 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 16:08:13 GMT]]>@Larvitz We are using podman for a year now as a local Docker replacement for developing distributed apps (.NET, Postgres, MSSQL, Kafka, etc.) on MacOS/Windows. The early quirks are gone, several months now without an issue.

]]>https://forum.fedi.dk/post/https://mastodon.social/users/svenhennessen/statuses/116358623617745921https://forum.fedi.dk/post/https://mastodon.social/users/svenhennessen/statuses/116358623617745921Mon, 06 Apr 2026 16:08:13 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 13:37:59 GMT]]>@Larvitz thanks. I never took the time to explore Podman, I think I will do it in close future thanks to your nice article 👍

]]>https://forum.fedi.dk/post/https://toot.iopush.net/users/oliv/statuses/116358032907262730https://forum.fedi.dk/post/https://toot.iopush.net/users/oliv/statuses/116358032907262730Mon, 06 Apr 2026 13:37:59 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 12:45:22 GMT]]>@Slash909uk

https://burningboard.net/@Larvitz/116357824557155636

🙂

]]>https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116357825966446005https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116357825966446005Mon, 06 Apr 2026 12:45:22 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 12:40:00 GMT]]>@Larvitz Thanks for this great guide! I’m also a heavy user of
podman since years, and it's my number one solution for deploying services.

I had a question about the pod-in-pod deployment of forgejo / traefik,
giving access to the docker.socket allows thoses pods to create pods, but then
it can create privileged pods which mount the root volume of the host, right?
Even with the NoNewPrivileges arg?

Is there a way to control what a pod having access to the docker.socket can
create?

]]>https://forum.fedi.dk/post/https://mastodon.social/users/arouene/statuses/116357804860085909https://forum.fedi.dk/post/https://mastodon.social/users/arouene/statuses/116357804860085909Mon, 06 Apr 2026 12:40:00 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 12:08:18 GMT]]>@Larvitz thanks, good to know there is BSD support already 👍

]]>https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116357680230262102https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116357680230262102Mon, 06 Apr 2026 12:08:18 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 11:46:04 GMT]]>@Slash909uk I doin't know of any alternatives. Quadlets are transniently transformed into systemd units by a generator. That's all very systemd specific.

FreeBSD's Podman port ships with rc.d service scripts already. You enable them with:

sysrc podman_enable=YES
service podman start
sysrc podman_service_enable=YES
service podman_service start

Then, containers started with --restart=always will be automatically restarted after a host reboot. Podman's internal restart logic handles this, with the podman service acting as the supervisor. This is the closest equivalent to what quadlets do on Linux.

]]>https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116357592806423110https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116357592806423110Mon, 06 Apr 2026 11:46:04 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 11:32:15 GMT]]>@Larvitz nice!

I am halfway with podman; still have compose files launched from systemd units that I write myself - they are all basically identical except the home directory setting 🙂

I deliberately use compose start only, not run. I do not want restarts to be messing about pulling new images when I dont expect it!

Is there an equivalent to quadlets for alternative init tools? I would not want to lock myself into systemd right now 😁 seriousky looking at BSD.

]]>https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116357538454092169https://forum.fedi.dk/post/https://mastodon.me.uk/users/Slash909uk/statuses/116357538454092169Mon, 06 Apr 2026 11:32:15 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 09:57:09 GMT]]>@Larvitz Thank you. I might have to dig a bit further into this.

]]>https://forum.fedi.dk/post/https://toot.cafe/users/art_codesmith/statuses/116357164564249190https://forum.fedi.dk/post/https://toot.cafe/users/art_codesmith/statuses/116357164564249190Mon, 06 Apr 2026 09:57:09 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 09:42:24 GMT]]>@Larvitz I have been planning tot migrate tot podman but life has many priorities
Will read

]]>https://forum.fedi.dk/post/https://ieji.de/users/hanscees/statuses/116357106533450753https://forum.fedi.dk/post/https://ieji.de/users/hanscees/statuses/116357106533450753Mon, 06 Apr 2026 09:42:24 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 09:36:38 GMT]]>@Larvitz I might be wrong but, don't you lose basically all advantages of Podman by doing so? Having to give up daemonless and rootless.

]]>https://forum.fedi.dk/post/https://toot.cafe/users/art_codesmith/statuses/116357083869366633https://forum.fedi.dk/post/https://toot.cafe/users/art_codesmith/statuses/116357083869366633Mon, 06 Apr 2026 09:36:38 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 09:34:27 GMT]]>@Larvitz Interesting.
For me, the poor Compose support is one of the reasons I'm still sticking with Docker for development. Although, I think, the advantage of Compose files is simplicity (not having to commit to the whole systemd units system).

]]>https://forum.fedi.dk/post/https://toot.cafe/users/art_codesmith/statuses/116357075295617302https://forum.fedi.dk/post/https://toot.cafe/users/art_codesmith/statuses/116357075295617302Mon, 06 Apr 2026 09:34:27 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 06:23:18 GMT]]>@Larvitz Now I know what I'll be reading tomorrow!

I made the switch about two years ago and use Podman for embedded systems development. It's much easier than spinning up a VM and combined with VSCodium makes a nice IDE that allows remote debugging.

]]>https://forum.fedi.dk/post/https://cosocial.ca/ap/users/116279501467552162/statuses/116356323637856993https://forum.fedi.dk/post/https://cosocial.ca/ap/users/116279501467552162/statuses/116356323637856993Mon, 06 Apr 2026 06:23:18 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 06:03:26 GMT]]>@Larvitz very good starter pack for podman! I'd say all the normal operations described well and then some. Only thing more I use is exec for various debugging things or fixing something in storage. But if this is for docker users, there is no difference.

]]>https://forum.fedi.dk/post/https://mementomori.social/users/ikkeT/statuses/116356245537225488https://forum.fedi.dk/post/https://mementomori.social/users/ikkeT/statuses/116356245537225488Mon, 06 Apr 2026 06:03:26 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Mon, 06 Apr 2026 01:46:53 GMT]]>@Larvitz Thanks for the article.
I never went beyond podman compose because I couldn't really find beginner-friendly examples on how to use Quadlets in production, so this is a great reference on how to get started.

]]>https://forum.fedi.dk/post/https://infosec.exchange/users/patlikestechnology/statuses/116355236728553380https://forum.fedi.dk/post/https://infosec.exchange/users/patlikestechnology/statuses/116355236728553380Mon, 06 Apr 2026 01:46:53 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Sun, 05 Apr 2026 21:11:48 GMT]]>@Larvitz I love podman too, but recently I’ve been wondering about running rootless containers that aren’t tied to a specific host user. I’ve posted this as a discussion topic here - thoughts? https://github.com/containers/podman/discussions/28445

]]>https://forum.fedi.dk/post/https://fosstodon.org/users/woodsb02/statuses/116354155074035796https://forum.fedi.dk/post/https://fosstodon.org/users/woodsb02/statuses/116354155074035796Sun, 05 Apr 2026 21:11:48 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Sun, 05 Apr 2026 17:28:27 GMT]]>@Larvitz Maybe you could add the hint, that automatic starting of rootless quadlets needs an user, where lingering is enabled.
It can be found at the examples.
https://docs.podman.io/en/latest/markdown/podman-system-service.1.html
```
loginctl enable-linger <USER>
```

]]>https://forum.fedi.dk/post/https://norden.social/users/db_geek/statuses/116353276808542486https://forum.fedi.dk/post/https://norden.social/users/db_geek/statuses/116353276808542486Sun, 05 Apr 2026 17:28:27 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Sun, 05 Apr 2026 16:51:26 GMT]]>@andrew That blog article took me the longest of them all. A first draft had been lingering in my blog's git repo since November last year, and I went through numerous rewrites of various parts until I found them good enough. Today, I added the final paragraph about Ansible and decided to publish it before I end up waiting another 6 months 😂

]]>https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116353131220704624https://forum.fedi.dk/post/https://burningboard.net/users/Larvitz/statuses/116353131220704624Sun, 05 Apr 2026 16:51:26 GMT<![CDATA[Reply to Running Podman in production for years now, and I don't miss the Docker daemon one bit. on Sun, 05 Apr 2026 16:47:07 GMT]]>@Larvitz another person of culture I see…/me tips hat

I’ve been operating with a mixture of quadlets and manual podman-compose containers for quite some time. I’ve found compatibility issues with some projects, but I decided those do not justify switching to docker. There’s also an annoying race condition with CNI coming up before networkmanager, but manual fix is easy enough for those times.

Great blog post! Thanks

]]>https://forum.fedi.dk/post/https://mastodon.furrow.me/ap/users/115923467670715698/statuses/116353114278913983https://forum.fedi.dk/post/https://mastodon.furrow.me/ap/users/115923467670715698/statuses/116353114278913983Sun, 05 Apr 2026 16:47:07 GMT