I’ve long wanted to Dockerize the main applications and services running on this personal server. The main goal would be to make it easier to upgrade the OS and/or move servers, which I seem to do every 2 years or so. All I’d have to do is build my containers on the new host and copy over the data volumes. The other concern is improved security: containers would help wall off applications and limit exposure if one of them is compromised.
While I was at it, I thought I’d try Podman instead. I like the idea of running rootless, for even better security.
While Podman is pretty painless to use as a drop-in replacement for Docker (you can even install “podman-docker” and “podman-compose” packages so the “docker” command is aliased to “podman”), its default system behaviors are actually very different out of the box. I thought I’d write up a few notes here on what I had to do to get it working well for me. I’m running Ubuntu 26.04.
Allow the current user to run podman.
Run this:
systemctl --user enable --now podman.socket
Allow rootless containers to listen on privileged ports
By default, rootless containers aren’t allowed to bind to port < 1024 on the host. To run a web server like nginx and allow it to listen on port 80, I had to run these commands:
echo 'net.ipv4.ip_unprivileged_port_start=80' | sudo tee /etc/sysctl.d/50-rootless-ports.conf
sudo sysctl --system
Resolve short image names to docker hub
Out of the box, Podman won’t look for an image named “nginx:latest” on Docker Hub. You need to specifically point to that registry so unqualified names resolve there.
mkdir -p ~/.config/containers
nano ~/.config/containers/registries.conf
# add this line
unqualified-search-registries = ["docker.io"]
Allow containers to keep running after you logout
Unlike Docker, when you log out, Podman kills your containers. That’s not useful! Run this.
loginctl enable-linger $USER
Restart containers on reboot
Even if a container has a restart policy of “always”, Podman won’t automatically restart it after a reboot. You need to enable a restart service that will do this, like so:
systemctl --user enable podman-restart.service
systemctl --user start podman-restart.service