PODMAN - Install Podman on Linux Redhat

Production-Ready Step-by-Step Guide Rootless Podman + Quadlet on Red Hat Enterprise Linux 10

This guide is designed for a production environment. It uses the modern Quadlet method (recommended) and follows Red Hat best practices for RHEL 10.

---

1. System Requirements (Production)

Check cgroup version:

podman info --format '{{.Host.CgroupVersion}}'

---

2. Prepare the System

2.1 Register and Update RHEL 10

sudo subscription-manager register
sudo subscription-manager attach --auto
sudo dnf update -y
sudo reboot

2.2 Install Container Tools

sudo dnf install -y container-tools

Optional (Docker CLI compatibility):

sudo dnf install -y podman-docker

Verify:

podman --version
podman info

---

3. Create a Dedicated Service User (Best Practice)

For production, avoid running services under a regular interactive user.

# Create a system user for containers
sudo useradd -r -m -d /home/podman -s /bin/bash podman

# Set a strong password or disable password login
sudo passwd podman          # or lock the account later

Grant subordinate UIDs/GIDs (required for rootless):

sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 podman

---

4. Enable Lingering (Critical for Production)

This allows the user services to run even when the user is not logged in.

sudo loginctl enable-linger podman

Verify:

loginctl show-user podman | grep Linger
# Linger=yes

---

5. Configure Rootless Environment

Switch to the service user:

sudo -u podman -i

Create required directories:

mkdir -p ~/.config/containers/systemd
mkdir -p ~/.config/containers
mkdir -p ~/.local/share/containers

Optional but Recommended: Storage Configuration

cat > ~/.config/containers/storage.conf << 'EOF'
[storage]
driver = "overlay"
runroot = "/run/user/$(id -u)/containers"
graphroot = "$HOME/.local/share/containers/storage"

[storage.options.overlay]
mount_program = "/usr/bin/fuse-overlayfs"
mountopt = "nodev,fsync=0"
EOF

Optional: Registries Configuration

cat > ~/.config/containers/registries.conf << 'EOF'
unqualified-search-registries = ["registry.access.redhat.com", "registry.redhat.io", "docker.io", "quay.io"]

[[registry]]
location = "docker.io"
insecure = false
EOF

---

6. Create Your First Production Quadlet

Example: Nginx reverse proxy / web service

cat > ~/.config/containers/systemd/nginx.container << 'EOF'
[Unit]
Description=Nginx Web Server (Production)
After=network-online.target
Wants=network-online.target

[Container]
Image=docker.io/library/nginx:alpine
ContainerName=nginx
PublishPort=8080:80
Volume=nginx-data.volume:/usr/share/nginx/html:Z
Volume=nginx-conf.volume:/etc/nginx/conf.d:Z
AutoUpdate=registry
Environment=TZ=America/New_York
PodmanArgs=--memory=512m --cpus=1.0 --memory-swap=512m

[Service]
Restart=always
TimeoutStartSec=300

[Install]
WantedBy=default.target
EOF

Create supporting volumes:

cat > ~/.config/containers/systemd/nginx-data.volume << 'EOF'
[Volume]
VolumeName=nginx-data
EOF

cat > ~/.config/containers/systemd/nginx-conf.volume << 'EOF'
[Volume]
VolumeName=nginx-conf
EOF

---

7. Activate the Service

# Reload systemd user units
systemctl --user daemon-reload

# Start and enable
systemctl --user enable --now nginx.service

# Check status
systemctl --user status nginx.service
podman ps

View logs:

journalctl --user -u nginx.service -f

---

8. Production Hardening Checklist

Firewall example:

sudo firewall-cmd --permanent --add-port=8080/tcp
sudo firewall-cmd --reload

---

9. Useful Management Commands

# List all user services
systemctl --user list-units --type=service

# Restart a service
systemctl --user restart nginx.service

# Stop a service
systemctl --user stop nginx.service

# View resource usage
podman stats

# Update all containers with AutoUpdate
podman auto-update

---

10. Optional: Auto-Update Timer

Enable Podman’s auto-update timer (as the podman user):

systemctl --user enable --now podman-auto-update.timer

---

Summary of Key Directories (Rootless)