cheatsheet

podman Command in Linux: Run Containers, Images & Pods (RHEL/Fedora/Rocky)

podman runs OCI containers and pods without a central daemon. On RHEL, Rocky Linux, AlmaLinux, and Fedora it is the default container CLI — pull images, run rootless workloads, manage volumes and networks, and integrate with systemd and Quadlet.

Published

Updated

Read time 11 min read

Reviewed byDeepak Prasad

podman Command in Linux: Run Containers, Images & Pods (RHEL/Fedora/Rocky)
About podman runs OCI containers and pods without a central daemon. On RHEL, Rocky Linux, AlmaLinux, and Fedora it is the default container CLI — pull images, run rootless workloads, manage volumes and networks, and integrate with systemd and Quadlet.
Tested on Rocky Linux 10.2 (Red Quartz); podman 5.8.2; kernel 6.12.0-211.28.1.el10_2.x86_64
Man page podman(1)
Privilege none for rootless; sudo for privileged ports and system-wide config
Distros

RHEL 8+, Rocky Linux, AlmaLinux, CentOS Stream, and Fedora (default container engine).

Docker Engine workflows: Docker container guides.
Related guide

podman — quick reference

Containers — list and lifecycle

See what is running, start stopped containers, and remove finished ones.

When to use Command
List running containers podman ps
List all containers (including stopped) podman ps -a
Create a container without starting it podman create IMAGE COMMAND
Start an existing container podman start CONTAINER
Stop a running container podman stop CONTAINER
Restart a container podman restart CONTAINER
Remove one or more containers podman rm CONTAINER
Remove all stopped containers podman container prune

Run and exec

When to use Command
Run a command in a new container (foreground) podman run IMAGE COMMAND
Run detached in the background podman run -d --name NAME IMAGE COMMAND
Remove the container when the command exits podman run --rm IMAGE COMMAND
Map host port to container port podman run -d -p HOST:CONTAINER IMAGE
Bind-mount a host directory podman run -v /host/path:/ctr/path:Z IMAGE
Run a command inside a running container podman exec CONTAINER COMMAND
Interactive shell in a running container podman exec -it CONTAINER /bin/bash

Images

When to use Command
List local images podman images
Pull an image from a registry podman pull REGISTRY/IMAGE:TAG
Remove an image podman rmi IMAGE
Remove unused images podman image prune
Build from a Containerfile podman build -t NAME:TAG .
Tag an image with another name podman tag SOURCE TARGET

Volumes, networks, and inspection

When to use Command
Create a named volume podman volume create VOLUME
List volumes podman volume ls
Remove a volume podman volume rm VOLUME
List Podman networks podman network ls
Show port mappings for a container podman port CONTAINER
Show container logs podman logs CONTAINER
Follow logs like tail -f podman logs -f CONTAINER
Inspect JSON configuration podman inspect CONTAINER
Live resource usage podman stats --no-stream CONTAINER

System and info

When to use Command
Show Podman version podman --version
Show storage, runtime, and host details podman info
Disk use summary for images and containers podman system df
Reclaim unused data podman system prune
List subcommands podman --help

podman — command syntax

Synopsis from podman --help on Rocky Linux 10.2 (podman 5.8.2):

text 
Usage:
  podman [options] [command]

Available Commands:
  attach      Attach to a running container
  build       Build an image using instructions from Containerfiles
  create      Create but do not start a container
  exec        Run a process in a running container
  images      List images in local storage
  logs        Fetch the logs of one or more containers
  network     Manage networks
  pod         Manage pods
  ps          List containers
  pull        Pull an image from a registry
  rm          Remove one or more containers
  rmi         Remove one or more images from local storage
  run         Run a command in a new container
  start       Start one or more containers
  stop        Stop one or more containers
  volume      Manage volumes
  ...

Rootless Podman stores state under ~/.local/share/containers/; the system-wide graph root is /var/lib/containers/storage. Most docker-style flags work the same way on podman run.

podman — command examples

Essential Run a one-off command in a new container

When you only need a quick command from an image — no leftover container — combine run with --rm.

Run the command:

bash 
podman run --rm quay.io/rockylinux/rockylinux:9 echo hello-podman

Sample output:

text 
hello-podman

Podman pulled the image if needed, started a container, ran echo, printed the line, and removed the container because of --rm.

Essential Run a detached container with port mapping

Use -d for background workloads and -p to publish a container port on the host.

Run the command:

bash 
podman run -d --name glc-web -p 18080:80 quay.io/rockylinux/rockylinux:9 sleep 3600

Sample output:

text 
5f9d3730e1330707ee9e6ad71c6627b84d7eb38b3357068a90fbb175e77b92be

Confirm the mapping:

bash 
podman ps --format 'table {{.Names}}\t{{.Status}}\t{{.Ports}}'

Sample output:

text 
NAMES       STATUS        PORTS
glc-web     Up 3 seconds  0.0.0.0:18080->80/tcp

0.0.0.0:18080->80/tcp means host port 18080 forwards to port 80 inside the container. Clean up with podman stop glc-web && podman rm glc-web when you are done.

Common Run a command inside a running container

exec attaches a new process to an existing container — useful for debugging without restarting the workload.

Start a long-running container:

bash 
podman run -d --name glc-exec quay.io/rockylinux/rockylinux:9 sleep 3600

Run a command inside it:

bash 
podman exec glc-exec cat /etc/redhat-release

Sample output:

text 
Rocky Linux release 9.8 (Blue Onyx)

The release file comes from the image, not necessarily your host OS. Stop and remove the test container when finished.

Common Persist data with a named volume

Named volumes survive container removal — handy for databases and application data.

Run the command:

bash 
podman run --rm -v glc-data:/data:Z quay.io/rockylinux/rockylinux:9 sh -c 'echo data > /data/test.txt && cat /data/test.txt'

Sample output:

text 
data

The :Z suffix relabels the volume for SELinux on RHEL-family hosts. Remove the test volume with podman volume rm glc-data.

Common Create then start — split lifecycle steps

create builds the container object; start runs it. Some admins prefer this in scripts over a single run.

Run the commands:

bash 
podman create --name glc-create quay.io/rockylinux/rockylinux:9 sleep 600

Sample output:

text 
c19cbefd6e190c1f29f3ed69d065cd5a0d854569cfbb2cbbea38da162b403bf2

Start and verify:

bash 
podman start glc-create
podman ps --filter name=glc-create --format '{{.Names}} {{.Status}}'

Sample output:

text 
glc-create Up 2 seconds

Remove the test container with podman rm -f glc-create.

Common Check logs and resource use

logs shows stdout/stderr; stats gives a CPU and memory snapshot.

Run the commands:

bash 
podman logs glc-create 2>&1 | head -3
podman stats --no-stream glc-create

Sample output:

text 
ID            NAME        CPU %       MEM USAGE / LIMIT  MEM %       NET IO       BLOCK IO    PIDS
c19cbefd6e19  glc-create  11.11%      385kB / 4.099GB    0.01%       536B / 132B  0B / 0B     1

An empty logs line is normal for a sleep container. Use podman logs -f to follow output from services that print to stdout.

Essential Pull and list local images

Pull once, run many times — Podman stores images in local storage.

Run the commands:

bash 
podman pull quay.io/rockylinux/rockylinux:9
podman images --format '{{.Repository}}:{{.Tag}}  {{.Size}}'

Sample output:

text 
quay.io/rockylinux/rockylinux:9  244 MB

Use podman image prune to drop unused layers when disk space is tight.

Advanced See disk use across images and containers

Before pruning, check what Podman is holding on disk.

Run the command:

bash 
podman system df

Sample output:

text 
TYPE           TOTAL       ACTIVE      SIZE        RECLAIMABLE
Images         1           1           243.7MB     0B (0%)
Containers     0           0           0B          0B (0%)
Local Volumes  0           0           0B          0B (0%)

RECLAIMABLE shows space you could free with podman system prune or targeted image / volume prune commands.

Advanced Confirm runtime and storage settings

podman info is the first command when rootless mode, cgroup driver, or registry auth misbehaves.

Run the command:

bash 
podman info 2>&1 | head -20

Sample output:

text 
host:
  arch: amd64
  buildahVersion: 1.43.1
  cgroupControllers:
  - cpuset
  - cpu
  - io
  - memory
  ...
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-2.2.1-2.el10.x86_64
    path: /usr/bin/conmon

Look for cgroupManager: systemd and cgroupVersion: v2 on current RHEL-family releases. Rootless users should see a graph root under their home directory further down the output.

podman — when to use / when not

Use podman when Use something else when
  • You are on RHEL, Rocky Linux, AlmaLinux, or Fedora and want the supported daemonless container CLI
  • You need rootless containers without adding your user to the docker group
  • You want Docker-compatible commands (run, ps, build) integrated with systemd and SELinux
  • You are deploying with Quadlet, podman generate systemd, or RHEL container workflows
  • You prefer a fork/exec model instead of a long-running container daemon
  • Your team standardizes on Docker Desktop or the Docker Engine API → Docker container management
  • You orchestrate at cluster scale with Kubernetes — use kubectl / OpenShift tools, not single-host Podman alone
  • You only need low-level image builds without running containers → buildah
  • You are on a host without podman installed and cannot add packages → install from distro repos or use another runtime
  • You hit Docker Hub anonymous rate limits — authenticate with podman login or mirror images to a private registry

podman vs docker

Both speak similar CLI flags for day-to-day container work. The difference is architecture and defaults on RHEL-family Linux.

podman Docker Engine
Daemon Daemonless (fork/exec per container) Central dockerd daemon
Rootless First-class, default on many RHEL workflows Supported but less common
Socket Optional remote socket; no required group membership Often requires docker group for socket access
systemd Native Quadlet and generate systemd Possible with extra unit files
Best on RHEL, Rocky, Fedora, rootless servers Cross-platform dev teams, Compose-centric stacks

See Docker vs containerd for how the broader container stack fits together.

Nearby tools in the same container workflow — images, builds, orchestration, and cleanup.

Command One line
podman Daemonless OCI container CLI (this page)
systemctl Enable Podman-generated systemd units
ss Verify published container ports on the host

Browse the full index in our Linux commands reference.

podman — interview corner

What is podman and how is it different from Docker?

podman runs OCI containers on Linux without requiring a long-running container daemon. Each podman run forks a process tree managed by a lightweight runtime (typically crun) and conmon.

On RHEL-family distros, Podman is the default way to pull images, run rootless workloads, and wire containers into systemd. The CLI mirrors Docker closely — run, ps, exec, build — so most Docker examples translate with the command name swapped.

The big architectural difference: Docker Engine centers on dockerd and a socket; Podman is daemonless and fits rootless, SELinux-aware server workflows out of the box.

A strong answer is:

"Podman is the daemonless OCI container CLI on RHEL and Fedora — Docker-compatible commands, rootless by default, no central dockerd. I use it for single-host containers and systemd-integrated services."

Can podman run containers without root?

Yes. Rootless Podman maps container UIDs, uses user namespaces, and stores images under the caller's home directory (for example ~/.local/share/containers/).

That means an unprivileged user can build and run containers without membership in a privileged group — a common hardening goal on shared servers.

Check your graph root and IDs:

bash 
podman info | grep -E 'rootless|graphRoot|runRoot'

If port binding below 1024 or certain cgroup limits fail, run the specific workload as root or adjust capabilities — not every container fits rootless mode.

A strong answer is:

"Yes — rootless Podman uses user namespaces and stores state in the user's home directory. It's the default pattern on RHEL for non-admin container workloads, though privileged ports and some devices still need root or extra caps."

How do you remove stopped containers and unused images?

Remove a named container:

bash 
podman rm CONTAINER

Force-remove a running one:

bash 
podman rm -f CONTAINER

Bulk cleanup:

bash 
podman container prune
podman image prune
podman system prune

prune commands ask for confirmation unless you pass -f. Always list first with podman ps -a and podman images so you do not delete data a compose stack still references.

A strong answer is:

"I use podman rm for named containers, container prune for all stopped ones, and image or system prune to reclaim disk — after checking ps and images so I don't remove something a service still needs."

Why do Podman volume mounts sometimes need :Z or :z?

On SELinux-enforcing hosts (default on RHEL), bind mounts and volumes need a label the container process may access. The :Z suffix relabels the volume for private container use; :z allows shared content across containers.

Without the suffix you may see permission denied errors even when DAC permissions look correct.

Example:

bash 
podman run --rm -v /opt/data:/data:Z IMAGE

A strong answer is:

"SELinux blocks containers from arbitrary host paths — :Z or :z on -v tells Podman to relabel the mount for container access. I use :Z for single-container private data."

How do you run a container as a systemd service?

Generate a unit file from a running or created container:

bash 
podman generate systemd --name myapp --files

Or define a Quadlet unit under /etc/containers/systemd/ on newer RHEL releases so systemd starts the container at boot.

Enable and start like any service:

bash 
sudo systemctl enable --now container-myapp.service

See create systemd service for general unit patterns.

A strong answer is:

"I either podman generate systemd from an existing container or use Quadlet drop-ins under /etc/containers/systemd, then enable the unit with systemctl — Podman integrates with systemd natively on RHEL."

Troubleshooting

Symptom Likely cause Fix
Error: short-name resolution enforced but cannot prompt Registries not fully qualified Use full image names (quay.io/...) or configure /etc/containers/registries.conf
cannot stat overlay / storage errors Corrupt or full graph root podman system df; prune unused data; check disk space on /var or $HOME
Bind for 0.0.0.0:80 failed: permission denied (rootless) Privileged port without capability Use a high port (-p 8080:80) or run rootful Podman
toomanyrequests on pull Docker Hub rate limit podman login docker.io or pull from a mirror (quay.io, private registry)
Permission denied on volume mount SELinux label Add :Z or :z to the -v option
Container exits immediately Wrong command or missing foreground process Check podman logs CONTAINER; use -d with a long-running CMD
Error: no such container Name typo or container already removed podman ps -a; recreate with podman run

References

Deepak Prasad

R&D Engineer

Founder of GoLinuxCloud with more than 15 years of expertise in Linux, Python, Go, Laravel, DevOps, Kubernetes, Git, Shell scripting, OpenShift, AWS, Networking, and Security. With extensive …

Related Articles

linux

How to Install Docker on Debian

Install Docker Engine on Debian 11, 12, or 13 from the official Docker CE APT repository with deb822 sources, …

8 min readlinux

Linux memory limits in containers (cgroups, Docker, Kubernetes)

Learn how Linux enforces memory limits inside containers using cgroups, how cgroup v1 and v2 differ, why tools …

23 min readdevops

Kubernetes Sidecar Pattern Explained with Real Examples (Multi-Container Pod YAML)

Learn how Kubernetes sidecar containers work with practical multi-container Pod examples. Understand shared …

17 min read