Podman Release Notes

Bugfixes

Fixed a bug where Podman Machine VMs on Mac using the libkrun provider could be regularly turned off by a port-scanning process on the host unintentionally commanding the VM to shut down.

Fixed a bug where the podman machine init command would fail on Windows hosts when using the hyperv provider when WSL was not installed (#29053).

Fixed a bug where the podman machine init command would fail on Windows hosts when using the wsl provider when the user was a Hyper-V admin but Hyper-V is disabled (#29138).

Fixed a bug where error messages from the OCI runtime were sometimes not displayed when --log-level=debug was passed to Podman.

Fixed a bug where the podman machine os upgrade command did not function properly (#29085).

Fixed a bug where the default image used by podman machine was not being properly cached (#29090).

Fixed a bug where rootful Podman Machine VMs on Windows using the wsl provider would fail to start (#29003).

Fixed a bug where commands that did not support the --replace option would incorrectly suggest using that option in error messages (#24537).

Fixed a bug where the Pesto rootless port forwarding tool (enabled by rootless_port_forwarder=pasta) did not properly clean up rules on container restart and network reload, causing failures to forward traffic (#29032).

Original source

We’re thrilled to announce that Podman v6.0.0 is now available! This major release brings a host of significant improvements and new features designed to enhance your container management experience. You can find the latest release on our GitHub, and it will be rolling out to your favorite package managers very soon.

Many thanks to all our contributors who helped make this release possible, especially new contributors!

Podman v6.0.0 is the result of months of work to modernize the project’s core infrastructure, enhance security, and improve user experience. Here are some of the key highlights:

Modernized Networking

We’ve made significant strides in modernizing Podman’s network infrastructure. This release transitions slirp4netns, and iptables towards Netavark, Pasta, and nftables, streamlining our networking stack to simplify maintenance and enable future features. Experimental support has been added for Pesto rootless port forwarding, which does support preserving the correct source ip for rootless containers on custom networks.

Enhanced podman machine Capabilities

Podman Machine now offers a more seamless multi-provider experience, making it easier to work across different VM providers. It also introduces the new podman machine os update command, which helps keep your VM environments up to date. There are many more improvements than we can cover here, and we’ll take a closer look at some of them in future posts.

Quadlet Evolution

Quadlets have received a major overhaul, including REST API support, improved tracking of associated files for easier management, expanded features for .volume units, and additional search paths for easier distribution packaging.

Podman Config Files Changes

Podman’s updated configuration file handling provides a smoother, more reliable experience for administrators managing multi-user environments. Please see this blog for exact details.

Compatibility Improvements

Podman continues to improve Docker compatibility by updating its Docker API support and refining its command output. Together, these make transitioning from Docker easier than ever.

For a full list of changes, please see the release notes.

Try it out!

We’re excited to share Podman v6.0.0 with everyone! We encourage you to try the new release, explore its features, and provide feedback. Your contributions and insights are invaluable to the continued growth and success of the Podman project.

This release wouldn’t be possible without our amazing community. We’re incredibly grateful to everyone who contributed to this cycle and thank you for being a part of the Podman community.

Original source

Security

This release addresses CVE-2026-57231, where a malicious image using malformed Env entries could cause host environment variables to leak into containers run based on the image, including the ability to use the * glob operator to leak large numbers of environment variables without knowing their exact names (GHSA-4hq8-gpf5-8p68).

The golang.org/x/crypto library has been updated to v0.53.0, addressing CVE-2026-39830 and CVE-2026-42508.

Bugfixes

Fixed a bug where the remote Podman client's podman save command would fail on Linux when using the -f oci-dir or -f docker-dir arguments.

Original source

Security

This release addresses CVE-2026-57231, where a malicious image using malformed Env entries could cause host environment variables to leak into containers run based on the image, including the ability to use the * glob operator to leak large numbers of environment variables without knowing their exact names (GHSA-4hq8-gpf5-8p68).

Breaking Changes

Due to breaking changes in this release, Podman v6.0.0 must be used with Buildah v1.44.0, Skopeo v1.23, Netavark and Aardvark v2.0.0, and configuration files from the container-libs repository's common/v0.68.0 release.

Support for BoltDB databases has been dropped. Starting Podman 6 when the BoltDB database is in use will have Podman attempt an automatic migration from BoltDB to SQLite.

Support for running on Intel Macs has been removed.

Support for running on Windows 10 has been removed.

Support for running on cgroups v1 systems has been removed. Please update your system to use cgroups v2.

Support for running on iptables has been removed. Please use nftables instead.

Support for CNI networking has been removed. Please use Netavark instead.

Support for the slirp4netns rootless network stack has been removed. Please use Pasta instead. As part of this, the --network-cmd-path global option, only used with slirp4netns, has been removed.

Podman's configuration file parsing logic has seen a major rewrite. Please see this document for exact details.

Podman's import path has changed from github.com/containers/podman/v5 to go.podman.io/podman/v6 as part of our move into a CNCF-owned GitHub organization.

Network isolation now defaults to enabled, improving Docker compatibility and security. A special workaround for the Docker-compatible API related to isolation being disabled has been removed (#27349).

The way the podman quadlet suite of commands functions has been changed. Previously, Quadlets and their associated files were tracked using a .app file, ensuring that removing a Quadlet also removed all associated non-Quadlet files. Now, Quadlets and associated files are placed in subdirectories, which should reduce bugs and make manual management of Quadlets added by podman quadlet install much easier.

VMs made by podman machine on Linux now mount volumes from the host using systemd. Volume mounts on existing podman machine VMs on Linux have been broken by this change, and the VM will need to be recreated.

The podman volume prune command now matches Docker's behavior by only pruning unused anonymous volumes. Please use the newly-added --all option for the previous behavior (pruning all volumes).

The podman volume list command now combines multiple filters using logical AND instead of logical OR (meaning all filters must match for a container to be included in output) (#26786).

The label!= filter used in many commands now combines the output of multiple instances of the filter with logical AND instead of logical OR.

The --format='{{json .Labels}} option to the podman ps, podman pod ps, and podman volume ls commands now prints its output as comma-separated key=value pairs instead of as a JSON map, improving Docker compatibility (#21847).

The --all-providers option to podman machine list has been removed, as machines from all providers can now be accessed by all commands.

The MemorySwappiness field of podman inspect is now set to nil when not explicitly set by the user (instead of -1), improving Docker compatibility (#23824).

The podman commit command now pauses the container while committing changes, improving security by restricting concurrent modification. The prior behavior can be restored by using podman commit --pause=false ....

The Go bindings for the REST API have removed the redundant nameOrID parameter from the artifacts.Remove() function.

The minimum Go version required to build Podman is now v1.25.

Features

All podman machine commands can now operate on VMs from all providers, regardless of what the current provider is set to. The provider set in the configuration only determines the provider used by newly-created VMs, and can be overridden by the new podman machine init --provider option. This should make operation of Mac and Windows installs mixing use of applehv and libkrun VMs, or hyperv and wsl VMs, much easier.

A new command has been added, podman machine os update, which updates the operating system of a podman machine VM. Please note that this is not supported with the wsl provider.

A new command has been added, podman system hyperv-prep, allowing Windows administrators to prepare a host for their users to run podman machine VMs using the hyperv provider.

When starting a VM with podman machine start and podman machine init --now, if the connection to that VM is not the default, users will be prompted whether they want to change the default to the machine that was just started. This can also be controlled by a new option, --update-connection, which controls whether the default will be updated. If the --update-connection option is set, a user-interactive prompt is not displayed.

The podman machine init and podman machine set commands now support a new option, --import-native-ca, which, when set, causes podman machine VMs on Windows, Linux, and Mac to import the host's trusted CA certificates each time the VM boots.

The podman exec command now has a new option, --no-session, disabling API session tracking and database operations to increase performance (#26727).

The podman image list --format json command now includes two new fields for each image, Repository and Tag (#27632).

The manpages for Quadlets have been split into multiple files, one for each type of Quadlet file, and should be much more readable.

Quadlet .volume units now support three new keys, UID= and GID= (to set the UID and GID that the volume will be created with) and Options= (to set generic volume options).

Quadlet .container units now support mounting anonymous volumes (using a Mount= key with no source specified) (#28497).

Two new search paths for Quadlets have been added, /usr/share/containers/systemd/users and /usr/share/containers/systemd/users/${UID}, to allow distributions to more easily package and distribute Quadlets (#27843).

The podman quadlet list command now has a new alias, podman quadlet ls.

The podman quadlet list command now has a new option, --noheading, which disables printing the table header. This is set automatically if the --format option is used.

The pomdan quadlet list command now includes a new field in its output, Pod, which prints the pod a Quadlet .container unit is part of.

The podman quadlet list command's --filter option now supports a new filter, status= (#28369).

The --gpus option to podman create and podman run is now compatible with AMD GPUs.

The podman create, podman run, and podman pod create commands can now specify volumes with a new option, nocreate (e.g. podman run --mount type=volume,src=myvol,dst=/mnt,nocreate) which will error if the specified volume does not exist, instead of creating it.

The --log-opt option to the podman run and podman create now supports a new option, label=, to attach additional labels to logged messages (only usable with the journald log driver).

Many Podman commands now expose a --tls-details option, allowing custom tuning of TLS settings using a containers-tls-details.yaml(5) file.

The died event for Containers now exposes a new attribute, OOMKilled, which (if set) indicates the container was stopped due to running out of memory (#26701).

Containers can now set multiple static IP addresses by passing the ip= option to --net multiple times (e.g. --net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4).

The podman volume prune command now includes a new option, --all, to prune all unused volumes, not just anonymous volumes (#24597).

The podman volume prune command now includes a new option, --dry-run, which returns the volumes that would be removed but does not actually remove them (#27838).

The podman image scp command now includes a new option, --format, to set the archive format used for the image transfer (#28183).

A new field has been added to containers.conf, default_host_ips, to set the default host IP that ports are forwarded from if an IP is not specified by the user (#27186).

The podman image trust suite of commands now support a new --signature-policy option, which is mandatory for podman image trust set.

Events now include artifact lifecycle events (create, pull, push, and remove) (#27260).

A new experimental option for the rootless_port_forwarder field in containers.conf has been added, rootless_port_forwarder="pasta". When set, rootless bridge networks will use Pasta's kernel-level port forwarding via Pesto instead of rootlessport, preserving the original client source IP in network traffic in rootless containers. The default remains rootlessport (the default for Podman 5.x), but we will investigate switching at a later date when stability is more certain.

A new filter has been added to the podman ps and podman container prune commands, --filter annotation=, to filter containers based on their annotations (#28562).

The podman network create command's --route option can now create blackhole, unreachable, and prohibit routes to prevent containers from reaching certain networks (e.g. podman network create --route 10.20.30.40/24,blackhole ...) (#20022).

Add support for blackhole, unreachable, and prohibit route types in podman networks. Supported since netavark 2.0.

The podman info command now reports CDI spec directories and discovered CDI devices.

Events generated by pods and volumes now include the pod/volume's labels as attributes, matching the behavior of container events (#26480).

Changes

VMs created by podman machine now mount the host's user configurations (e.g. ~/.config/containers on Linux) into the machine at /etc/containers, allowing users to edit the config files controlling Podman's behavior directly.

The default podman machine provider on Macs has been changed to libkrun.

Starting and stopping podman machine VMs on Windows with the hyperv provider no longer requires administrator privileges (creating machines still requires admin, however). Operations requiring elevated privileges will prompt for administrator access. Please note that this only works with newly-created VMs.

The podman pod inspect command now prints arrays in its output in deterministic order.

The podman machine os apply command has been updated, and now uses bootc switch to apply changes. All transports supported by bootc switch can be used for the new image to apply.

An experimental feature has been added where, on systems using Kernel 6.18 and newer, rootless Podman will no longer need to create a pause process to hold open the rootless user namespace, instead using an nsfs file handle. This behavior is currently gated behind an environment variable, drop-pause-process, being set.

Containers created with --net=host will now use 127.0.0.1 for their host.containers.internal address, instead of a public IP of the machine (#27823).

Containers in multiple networks now have these networks configured in a deterministic order based on the order they were passed on the command line.

When building an image with process substitution, such as podman build -f <(<<<"FROM scratch") , an empty temporary directory is now used as the context directory (#28113).

In Podman versions 5.x and under, image IDs (for both OCI and Docker v2s2 images) were always equal to the SHA256 digest of the image's config data. A future version of Podman will add support for non-SHA256 digests, and image ID format will change for images that are not using the SHA256 digest. The exact format of the new IDs has not yet been decided, but the assumption that image IDs are valid hashes will no longer be true in future Podman versions.

Bugfixes

Fixed a bug where creating a Quadlet from a templated .container file that was part of a pod would incorrectly add a dependency on the template used for the container to the pod (#27844).

Fixed a bug where Quadlet .pod files would unconditionally set Restart=on-failure even when the user specified an alternative restart policy (#28081).

Fixed a bug where starting a podman machine VM on Windows using the hyperv provider would fail if the machine failed to start on first boot (#27930).

Fixed a bug where podman machine init and podman machine set allowed creating VMs with more CPUs than were available on the host, creating VMs that could not be started (#28322).

Fixed a bug where artifact volumes only checked the validity of the artifact when the container was started, allowing containers to be created that referenced artifacts which did not exist and thus could never be started (#27747).

Fixed a bug where containers with environment secrets could lose the value of the secret after a restart under some circumstances (#28075).

Fixed a bug where the podman container restore --publish command would silently ignore the --publish option instead of erroring when used without the --import option or a checkpoint image.

Fixed a bug where running nested rootless Podman containers on Windows using the wsl provider was not possible (#27411).

Fixed a bug where the podman container clone command would fail with containers created with environment secrets (--secret type=env,...) (#28130).

Fixed a bug where creating a container with the tag= log option (--log-opt tag=mytag) was allowed when a log driver other than journald was selected.

Fixed a bug where the output of --help with some commands was incorrectly formatted (#28178).

Fixed a bug where containers in pods with multiple volume mounts could have mount options from one volume mount leak to other mounts.

Fixed a bug where the remote Podman client's podman version command would error if the server could not be connected to (e.g. the podman machine VM was shut down). In this case, client version is now printed (#28222).

Fixed a bug where rootless Podman would display errors and refuse to launch if the pause process was killed and its PID recycled to another process (#28157).

Fixed a bug where running podman kube generate on a container including volumes with . characters in their names produced invalid YAML (#27620).

Fixed a bug where patterns in .containerignore and .dockerignore files that began or ended with slashes were silently ignored during remote builds (#25458).

Fixed a bug where healthchecks on containers created using the --transient-store option would fail (#28483).

Fixed a bug where the podman generate spec command would panic when run on a pod with no infra container (#21609).

Fixed a bug where the podman container inspect command could HTML-escape certain characters in its output (#28560).

Fixed a bug where pods with entries added to /etc/hosts containing multiple containers would incorrectly remove entries from /etc/hosts for all containers in the pod when any container stopped.

Fixed a bug where hosts without /dev/mqueue could be unable to start containers as Podman attempted to add the device unconditionally.

Fixed a bug where inspecting networks without a gateway set would show the gateway as <nil> instead of the showing nothing (#28705).

Fixed a bug where creating a container or pod with port mappings including duplicated host ports was allowed, when this configuration could never be started due to the port conflict.

Fixed a bug where the remote Podman client was unable to connect to any host with a custom HostName in the user's SSH config (#25067).

Fixed a bug where the podman inspect --type=all command would, when attempting to inspect multiple networks, output only one of the networks multiple times.

Fixed a bug where Quadlet .container files using the http_proxy=true setting did not properly escape special characters in the environment variables added to the container when creating the systemd unit file (#28698).

Fixed a bug where containers created using the remote Podman client ignored the log_path setting in containers.conf (#28792).

Fixed a bug where the remote Podman client's podman save command would fail on Linux when using the -f oci-dir or -f docker-dir arguments.

Fixed a bug where podman machine VMs on Linux would fail to mount the directories under a symlinked path into the VM (#28911).

Fixed a bug where the podman container checkpoint --leave-running command could produce inconsistent checkpoints because the rootfs and named volume diffs were performed after the processes were allowed to run for a time; the container is now paused until the checkpoint is fully complete.

Fixed a bug where the podman kube play command would incorrectly set memory limits if the user specified the limit as a fractical BinarySI quantity (e.g. 1.5Gi) (#28789).

API

An improvement pass has been made over API documentation to document fields which were missing documentation. Look forward to more API documentation improvements in future releases!

The supported Docker Compatible API version has been bumped to v1.44.

All API requests that accept JSON body parameters will no longer error if an empty body is provided.

The Compat List endpoint for Containers now includes a new field in its output, Health, providing information on the status of the container's healthcheck (#27786).

Added a new API, POST /libpod/local/artifacts/add, for loading artifacts from the local system (not requiring transmission of a tarball).

The POST /libpod/local/images endpoint for loading images from the local system now requires that the path query parameter is an absolute path, not a relative path.

The Libpod Pull endpoint for Images can now report pull progress when the pullProgress query parameter is set to true.

The Libpod Pull endpoint for Images now returns error status codes on failure to pull imges, instead of always returning HTTP 200.

Fixed a bug where the subpath option for volumes when creating containers was ignored (#27171).

Fixed a bug where the Libpod Create endpoint for Containers ignored the OCIRuntime field.

Fixed a bug where the Compat Create endpoint for Containers returned a 500 (not a 409) when attempting to create a container with a name that was already in use.

Fixed a bug where the Compat Create endpoint for Containers incorrectly handled CDI-qualified entries in HostConfig.Devices, greatly improving the reliability of CDI devices when using the Compat API.

Fixed a bug where the Compat Info endpoint did not return the location of the Seccomp profile if a non-default profile was in use (#28379).

Fixed a bug where the Compat List endpoint for Containers could return an invalid string for container status (#28359).

Fixed a bug where the Compat List endpoint for Containers did not include the HostConfig field in its responses.

Fixed a bug where the Compat Wait endpoint for Containers would hang indefinitely when waiting for the next-exit condition (#28514).

Fixed a bug where the Compat and Libpod Update endpoints for Containers would clear the rlimits of the container if they were not explicitly set in the API request.

Fixed a bug where the Compat Push endpoint for Images did not return a final JSON object including tag, digest, and size of the pushed image, as Docker does.

Misc

Autocomplete has been enabled for inspecting artifacts with podman inspect.

Updated Buildah to v1.44.0

Updated the image library to v5.40.0

Updated the storage library to v1.63.0

Updated the common library to v0.68.0

Original source

Podman 6 is about to be released soon, so I would like to talk about the biggest change we made: a major rework of how we handle and parse our configuration files. This does not just affect Podman but also Buildah, Skopeo, and many other tools building on top of our underlying go.podman.io/image and go.podman.io/storage libraries.

The following files or locations are affected by this rework:

• containers.conf
• registries.conf
• storage.conf
• policy.json
• registries.d
• certs.d

History

Before diving into the details on what changed, let us have a look at why we felt the need to do this. While Podman is a large application, we do also maintain our other tools such as Buildah and Skopeo. They do similar things, for example, pull an image; so there is a strong need for code sharing across our tools. To facilitate that, we use the go.podman.io/storage (used to be known as containers/storage), go.podman.io/image (used to be known as containers/image) and go.podman.io/common (used to be known as containers/common) go libraries, which are now part of container-libs project.

Now I wasn’t around in the early days of the project but the fact is that Podman is our newest application given that both Skopeo and Buildah were created before it. The storage and registry libraries were created before Podman as well. Digging a bit into our git history I found the first storage.conf addition was in May 2017 and the first registries.conf addition in August 2017.

The first commit in the Podman repo is from November that same year.

Based on that and the fact that these projects all were in its early days, I can assume the focus was just to have something working. In the early days there was not even yet rootless support which means the config files did not account for that initially either. These things were added on top later and so started a long time adding specific features to specific files.

One problem was that the config file lived in different repositories using different code to parse the files, so over time they diverged more and more and got different rules with weird special cases.

For example because storage.conf contains the storage paths, graphroot and runroot, which had to be set there they point to a root owned place such as /var/lib/containers. That then made it impossible for a rootless user to use these paths so storage.conf opted for a rule to not read these fields in the /etc/containers/storage.conf location and just rely on user configuration in ~/.config/containers/storage.conf. But then administrators also wanted to set a global default path for all users so a rootless_storage_path was added which was read in the /etc location so we ended up with complicated logic to parse only certain fields in certain contexts.

Over the years we also got other demands, support for having the config file in /usr/share/containers. This support was added to some but not all files, simply because adding across many repos would have been a lot of work so often things were only fixed in places where we had user requests but not consistently for other files.

Ultimately we ended up with a lot of code scattered across three repositories and many differences. This resulted not just in problems for our users but also us maintainers as we needed to learn 3+ different parsing rules. Every time someone asked me how/where to set option X, I had to check what special cases exist for this file.

One thing that helped here is that we integrated our three libraries (storage, image and common) into a single monorepository last year which allowed us to make changes across all of them more efficiently.

With Podman 6 on the horizon and many user issues about various small things in regard to our different config files, we decided it is time to solve this and unify the behaviors and make them share code to reduce tech debt.

Given that some config files just have different and conflicting behaviors it means that there was really no way to avoid some breaking changes so waiting for the major release was the logical choice.

Goals

The main aim of the changes is to unify the config file parsing experience. Instead of using a different set of config file locations, .i.e. some supported /usr/share/containers others did not, we like to have the same set of search locations across all files. In particular, adding support for /usr/share/containers means packagers can deliver the config file there and administrators can use /etc/containers without having to deal with package conflicts on upgrades.

There are also various new use cases we wanted to solve. We often have asks from admins that they want to configure certain config options only for all users but not root or the other way around. If /etc/containers/registries.conf is read for all users that is of course not suitable.

Another thing is the inconsistent use of XDG_CONFIG_HOME for the user config files. Some files did honor it while others did not. We should use it consistently for all files.

We also have some config files that use environment variables overwrites for the file locations. This is very useful for local testing of certain options so the goal is to ensure other files can support an overwrite as well.

Changes

All files will now be looked up under /usr/share/containers as well if there were not previously. In addition we use XDG_CONFIG_HOME if set for the per user config file lookup. This is now also used for the root user so a root only config could be put under /root/.config/containers.

The biggest change is how we search and order the config files, the new logic is inspired by the UAPI Configuration Files Specification. That means that as a first step we look for the main file and only read one file. So if both ~/.config/containers/containers.conf and /etc/containers/containers.conf exist the code only reads the one with the higher precedence which is the one in the home directory. Then it loads the drop-in directory files (filenames must end in .conf) from all search hierarchies. All drop-in files will be sorted in the lexicographic order of the file name, if there are two or more drop-in files with the same file name only the one with the highest precedence will be used and thus replaces the prior one.

Note I am using the linux paths in the examples here, please see the containers-config(5) man page for more info about the other paths.

The following locations are searched:

• /usr/share/containers
• /etc/containers
• $XDG_CONFIG_HOME/containers or $HOME/.config/containers if XDG_CONFIG_HOME is not set

The locations contain the main file and its drop-in directory, .i.e. containers.conf and containers.conf.d/. In addition for the /usr and /etc locations there will be the additional containers.rootful.conf.d/ directory when running as root (uid 0) or when running as rootless then containers.rootless.conf.d/ and containers.rootless.conf.d/$UID/. These locations are there to allow setting system wide defaults for just root or the rootless users. The per UID subdirectory is there to allow an administrator to set a setting for just one user without having to edit their home directory content.

So now let us have a look at what this means in practice for the various files.

containers.conf

The containers.conf file logic changes because previously all files were read in order of their precedence. So previously /usr/share/containers/containers.conf, /etc/containers/containers.conf, and ~/.config/containers/containers.conf got read all in order. Now only the file with the highest precedence is read. Similarly for the drop-in files, now ~/.config/containers/containers.conf will be read before a drop-in file from /etc/containers/containers.conf.d/.

The support for reading /etc/containers/containers.rootless.conf was dropped in favour of the drop-in directory /etc/containers/containers.rootless.conf.d/.

storage.conf

With the new parsing logic storage.conf now gains support for drop-in configuration files which was an often requested feature. In addition the new storage.rootless.conf.d/ storage.rootful.conf.d/ drop-in directory locations allow configuring options system wide for all users, not just some special options like rootless_storage_path.

Because of this the rootless_storage_path field has been deprecated, instead set graphroot to the same value in a drop-in file under storage.rootless.conf.d/.

Now previously many distributions shipped a default storage.conf file that contained the graphroot=/var/lib/containers and runroot=/run/containers options. If that file stays in the default location it means rootless users will parse these and try to use the root owned paths causing runtime failures. If these options were set to these default values they just should be removed or commented out. If a specific root only graphroot was set then one must move these options to a new drop-in under storage.rootful.conf.d/ to avoid problems for the rootless users on the system.

registries.conf

The registries.conf file no longer supports the old v1 syntax and using it will result in an error. The v2 syntax is already around for many years so most users should have already moved to the new syntax, see the registry.conf man page for more details on the format.

With the new parsing logic, registries.conf now gains support for reading the default file under /usr/share/containers so packagers should ship the default file there. It also correctly uses XDG_CONFIG_HOME now for the per user file lookup.

registries.d

Note registries.d is not the drop-in format of registries.conf, it is a separate yaml file format to set registry specific signature options, see containers-registries.d(5).

Because this file only supports drop-in file locations it is a bit special in the parsing as there is no main file location. However the parsing and ordering of the drop-in files still happens as described with the other files.

This means it now gains support for reading files under /usr/share/containers/registries.d/. So any default packaged configs should be moved there.

policy.json

This is another special case, because we did not define any config option merging logic we do not support drop-in files for it. However we did add the /usr/share/containers/policy.json location as a search location. So packagers should move the default policy file there.

certs.d

This is also not a normal config file. Instead it is a directory location where users can provide custom TLS certificates for registries. So again the only change here is the addition of the /usr/share/containers/certs.d/ lookup location.

Note for Packagers

Due to the various (partially breaking) changes and the use of these config files from different tools it is important to update the various affected applications in sync. I also recommend moving all packaged config files to /usr/share/containers, which leaves /etc/containers empty for system administrators to use.

These config changes were released in the container-libs common/v0.68.0 release and then in our end user tools Podman 6.0, Buildah 1.44 and Skopeo 1.23. An example config change for the fedora package can be found here.

Also with Podman 6 and Buildah 1.44 we now also require the use of netavark and aardvark-dns v2. So these version updates must be added as well.

If there are any remaining packaging questions or problems please reach out to us by creating an issue.

Original source

Breaking Changes

Due to breaking changes in this release, Podman v6.0.0 must be used with Buildah v1.44.0, Skopeo v1.23, Netavark and Aardvark v2.0.0, and configuration files from the container-libs repository's common/v0.68.0 release.

Support for BoltDB databases has been dropped. Starting Podman 6 when the BoltDB database is in use will have Podman attempt an automatic migration from SQLite to BoltDB.

Support for running on Intel Macs has been removed.

Support for running on Windows 10 has been removed.

Support for running on cgroups v1 systems has been removed. Please update your system to use cgroups v2.

Support for running on iptables has been removed. Please use nftables instead.

Support for CNI networking has been removed. Please use Netavark instead.

Support for the slirp4netns rootless network stack has been removed. Please use Pasta instead. As part of this, the --network-cmd-path global option, only used with slirp4netns, has been removed.

Podman's configuration file parsing logic has seen a major rewrite. Please see this document for exact details.

Podman's import path has changed from github.com/containers/podman/v5 to go.podman.io/podman/v6 as part of our move into a CNCF-owned GitHub organization.

Network isolation now defaults to enabled, improving Docker compatibility and security. A special workaround for the Docker-compatible API related to isolation being disabled has been removed (#27349).

The way the podman quadlet suite of commands functions has been changed. Previously, Quadlets and their associated files were tracked using a .app file, ensuring that removing a Quadlet also removed all associated non-Quadlet files. Now, Quadlets and associated files are placed in subdirectories, which should reduce bugs and make manual management of Quadlets added by podman quadlet install much easier.

VMs made by podman machine on Linux now mount volumes from the host using systemd. Volume mounts on existing podman machine VMs on Linux have been broken by this change, and the VM will need to be recreated.

The podman volume prune command now matches Docker's behavior by only pruning unused anonymous volumes. Please use the newly-added --all option for the previous behavior (pruning all volumes).

The podman volume list command now combines multiple filters using logical AND instead of logical OR (meaning all filters must match for a container to be included in output) (#26786).

The label!= filter used in many commands now combines the output of multiple instances of the filter with logical AND instead of logical OR.

The --format='{{json .Labels}} option to the podman ps, podman pod ps, and podman volume ls commands now prints its output as comma-separated key=value pairs instead of as a JSON map, improving Docker compatibility (#21847).

The --all-providers option to podman machine list has been removed, as machines from all providers can now be accessed by all commands.

The MemorySwappiness field of podman inspect is now set to nil when not explicitly set by the user (instead of -1), improving Docker compatibility (#23824).

The podman commit command now pauses the container while committing changes, improving security by restricting concurrent modification. The prior behavior can be restored by using podman commit --pause=false ....

The Go bindings for the REST API have removed the redundant nameOrID parameter from the artifacts.Remove() function.

The minimum Go version required to build Podman is now v1.25.

Features

All podman machine commands can now operate on VMs from all providers, regardless of what the current provider is set to. The provider set in the configuration only determines the provider used by newly-created VMs, and can be overridden by the new podman machine init --provider option. This should make operation of Mac and Windows installs mixing use of applehv and libkrun VMs, or hyperv and wsl VMs, much easier.

A new command has been added, podman machine os update, which updates the operating system of a podman machine VM. Please note that this is not supported with the wsl provider.

A new command has been added, podman system hyperv-prep, allowing Windows administrators to prepare a host for their users to run podman machine VMs using the hyperv provider.

When starting a VM with podman machine start and podman machine init --now, if the connection to that VM is not the default, users will be prompted whether they want to change the default to the machine that was just started. This can also be controlled by a new option, --update-connection, which controls whether the default will be updated. If the --update-connection option is set, a user-interactive prompt is not displayed.

The podman machine init and podman machine set commands now support a new option, --import-native-ca, which, when set, causes podman machine VMs on Windows, Linux, and Mac to import the host's trusted CA certificates each time the VM boots.

The podman exec command now has a new option, --no-session, disabling API session tracking and database operations to increase performance (#26727).

The podman image list --format json command now includes two new fields for each image, Repository and Tag (#27632).

The manpages for Quadlets have been split into multiple files, one for each type of Quadlet file, and should be much more readable.

Quadlet .volume units now support three new keys, UID= and GID= (to set the UID and GID that the volume will be created with) and Options= (to set generic volume options).

Quadlet .container units now support mounting anonymous volumes (using a Mount= key with no source specified) (#28497).

Two new search paths for Quadlets have been added, /usr/share/containers/systemd/users and /usr/share/containers/systemd/users/${UID}, to allow distributions to more easily package and distribute Quadlets (#27843).

The podman quadlet list command now has a new alias, podman quadlet ls.

The podman quadlet list command now has a new option, --noheading, which disables printing the table header. This is set automatically if the --format option is used.

The pomdan quadlet list command now includes a new field in its output, Pod, which prints the pod a Quadlet .container unit is part of.

The podman quadlet list command's --filter option now supports a new filter, status= (#28369).

The --gpus option to podman create and podman run is now compatible with AMD GPUs.

The podman create, podman run, and podman pod create commands can now specify volumes with a new option, nocreate (e.g. podman run --mount type=volume,src=myvol,dst=/mnt,nocreate) which will error if the specified volume does not exist, instead of creating it.

The --log-opt option to the podman run and podman create now supports a new option, label=, to attach additional labels to logged messages (only usable with the journald log driver).

Many Podman commands now expose a --tls-details option, allowing custom tuning of TLS settings using a containers-tls-details.yaml(5) file.

The died event for Containers now exposes a new attribute, OOMKilled, which (if set) indicates the container was stopped due to running out of memory (#26701).

Containers can now set multiple static IP addresses by passing the ip= option to --net multiple times (e.g. --net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4).

The podman volume prune command now includes a new option, --all, to prune all unused volumes, not just anonymous volumes (#24597).

The podman volume prune command now includes a new option, --dry-run, which returns the volumes that would be removed but does not actually remove them (#27838).

The podman image scp command now includes a new option, --format, to set the archive format used for the image transfer (#28183).

A new field has been added to containers.conf, default_host_ips, to set the default host IP that ports are forwarded from if an IP is not specified by the user (#27186).

The podman image trust suite of commands now support a new --signature-policy option, which is mandatory for podman image trust set.

Events now include artifact lifecycle events (create, pull, push, and remove) (#27260).

A new experimental option for the rootless_port_forwarder field in containers.conf has been added, rootless_port_forwarder="pasta". When set, rootless bridge networks will use Pasta's kernel-level port forwarding via Pesto instead of rootlessport, preserving the original client source IP in network traffic in rootless containers. The default remains rootlessport (the default for Podman 5.x), but we will investigate switching at a later date when stability is more certain.

A new filter has been added to the podman ps and podman container prune commands, --filter annotation=, to filter containers based on their annotations (#28562).

The podman network create command's --route option can now create blackhole, unreachable, and prohibit routes to prevent containers from reaching certain networks (e.g. podman network create --route 10.20.30.40/24,blackhole ...) (#20022).

Add support for blackhole, unreachable, and prohibit route types in podman networks. Supported since netavark 2.0.

The podman info command now reports CDI spec directories and discovered CDI devices.

Events generated by pods and volumes now include the pod/volume's labels as attributes, matching the behavior of container events (#26480).

Changes

VMs created by podman machine now mount the host's user configurations (e.g. ~/.config/containers on Linux) into the machine at /etc/containers, allowing users to edit the config files controlling Podman's behavior directly.

The default podman machine provider on Macs has been changed to libkrun.

Starting and stopping podman machine VMs on Windows with the hyperv provider no longer requires administrator privileges (creating machines still requires admin, however). Operations requiring elevated privileges will prompt for administrator access. Please note that this only works with newly-created VMs.

The podman pod inspect command now prints arrays in its output in deterministic order.

The podman machine os apply command has been updated, and now uses bootc switch to apply changes. All transports supported by bootc switch can be used for the new image to apply.

An experimental feature has been added where, on systems using Kernel 6.18 and newer, rootless Podman will no longer need to create a pause process to hold open the rootless user namespace, instead using an nsfs file handle. This behavior is currently gated behind an environment variable, drop-pause-process, being set.

Containers created with --net=host will now use 127.0.0.1 for their host.containers.internal address, instead of a public IP of the machine (#27823).

Containers in multiple networks now have these networks configured in a deterministic order based on the order they were passed on the command line.

When building an image with process substitution, such as podman build -f <(<<<"FROM scratch") , an empty temporary directory is now used as the context directory (#28113).

In Podman versions 5.x and under, image IDs (for both OCI and Docker v2s2 images) were always equal to the SHA256 digest of the image's config data. A future version of Podman will add support for non-SHA256 digests, and image ID format will change for images that are not using the SHA256 digest. The exact format of the new IDs has not yet been decided, but the assumption that image IDs are valid hashes will no longer be true in future Podman versions.

Bugfixes

Fixed a bug where creating a Quadlet from a templated .container file that was part of a pod would incorrectly add a dependency on the template used for the container to the pod (#27844).

Fixed a bug where Quadlet .pod files would unconditionally set Restart=on-failure even when the user specified an alternative restart policy (#28081).

Fixed a bug where starting a podman machine VM on Windows using the hyperv provider would fail if the machine failed to start on first boot (#27930).

Fixed a bug where podman machine init and podman machine set allowed creating VMs with more CPUs than were available on the host, creating VMs that could not be started (#28322).

Fixed a bug where artifact volumes only checked the validity of the artifact when the container was started, allowing containers to be created that referenced artifacts which did not exist and thus could never be started (#27747).

Fixed a bug where containers with environment secrets could lose the value of the secret after a restart under some circumstances (#28075).

Fixed a bug where the podman container restore --publish command would silently ignore the --publish option instead of erroring when used without the --import option or a checkpoint image.

Fixed a bug where running nested rootless Podman containers on Windows using the wsl provider was not possible (#27411).

Fixed a bug where the podman container clone command would fail with containers created with environment secrets (--secret type=env,...) (#28130).

Fixed a bug where creating a container with the tag= log option (--log-opt tag=mytag) was allowed when a log driver other than journald was selected.

Fixed a bug where the output of --help with some commands was incorrectly formatted (#28178).

Fixed a bug where containers in pods with multiple volume mounts could have mount options from one volume mount leak to other mounts.

Fixed a bug where the remote Podman client's podman version command would error if the server could not be connected to (e.g. the podman machine VM was shut down). In this case, client version is now printed (#28222).

Fixed a bug where rootless Podman would display errors and refuse to launch if the pause process was killed and its PID recycled to another process (#28157).

Fixed a bug where running podman kube generate on a container including volumes with . characters in their names produced invalid YAML (#27620).

Fixed a bug where patterns in .containerignore and .dockerignore files that began or ended with slashes were silently ignored during remote builds (#25458).

Fixed a bug where healthchecks on containers created using the --transient-store option would fail (#28483).

Fixed a bug where the podman generate spec command would panic when run on a pod with no infra container (#21609).

Fixed a bug where the podman container inspect command could HTML-escape certain characters in its output (#28560).

Fixed a bug where pods with entries added to /etc/hosts containing multiple containers would incorrectly remove entries from /etc/hosts for all containers in the pod when any container stopped.

Fixed a bug where hosts without /dev/mqueue could be unable to start containers as Podman attempted to add the device unconditionally.

Fixed a bug where inspecting networks without a gateway set would show the gateway as <nil> instead of the showing nothing (#28705).

Fixed a bug where creating a container or pod with port mappings including duplicated host ports was allowed, when this configuration could never be started due to the port conflict.

Fixed a bug where the remote Podman client was unable to connect to any host with a custom HostName in the user's SSH config (#25067).

Fixed a bug where the podman inspect --type=all command would, when attempting to inspect multiple networks, output only one of the networks multiple times.

Fixed a bug where Quadlet .container files using the http_proxy=true setting did not properly escape special characters in the environment variables added to the container when creating the systemd unit file (#28698).

Fixed a bug where containers created using the remote Podman client ignored the log_path setting in containers.conf (#28792).

Fixed a bug where the remote Podman client's podman save command would fail on Linux when using the -f oci-dir or -f docker-dir arguments.

Fixed an issue that made podman-remote save -f oci-dir/docker-dir fail on linux.

API

An improvement pass has been made over API documentation to document fields which were missing documentation. Look forward to more API documentation improvements in future releases!

The supported Docker Compatible API version has been bumped to v1.44.

All API requests that accept JSON body parameters will no longer error if an empty body is provided.

The Compat List endpoint for Containers now includes a new field in its output, Health, providing information on the status of the container's healthcheck (#27786).

Added a new API, POST /libpod/local/artifacts/add, for loading artifacts from the local system (not requiring transmission of a tarball).

The POST /libpod/local/images endpoint for loading images from the local system now requires that the path query parameter is an absolute path, not a relative path.

The Libpod Pull endpoint for Images can now report pull progress when the pullProgress query parameter is set to true.

The Libpod Pull endpoint for Images now returns error status codes on failure to pull imges, instead of always returning HTTP 200.

Fixed a bug where the subpath option for volumes when creating containers was ignored (#27171).

Fixed a bug where the Libpod Create endpoint for Containers ignored the OCIRuntime field.

Fixed a bug where the Compat Create endpoint for Containers returned a 500 (not a 409) when attempting to create a container with a name that was already in use.

Fixed a bug where the Compat Create endpoint for Containers incorrectly handled CDI-qualified entries in HostConfig.Devices, greatly improving the reliability of CDI devices when using the Compat API.

Fixed a bug where the Compat Info endpoint did not return the location of the Seccomp profile if a non-default profile was in use (#28379).

Fixed a bug where the Compat List endpoint for Containers could return an invalid string for container status (#28359).

Fixed a bug where the Compat List endpoint for Containers did not include the HostConfig field in its responses.

Fixed a bug where the Compat Wait endpoint for Containers would hang indefinitely when waiting for the next-exit condition (#28514).

Fixed a bug where the Compat and Libpod Update endpoints for Containers would clear the rlimits of the container if they were not explicitly set in the API request.

Fixed a bug where the Compat Push endpoint for Images did not return a final JSON object including tag, digest, and size of the pushed image, as Docker does.

Misc

Autocomplete has been enabled for inspecting artifacts with podman inspect.

Updated Buildah to v1.44.0

Updated the image library to v5.40.0

Updated the storage library to v1.63.0

Updated the common library to v0.68.0

Original source

Security

This release addresses CVE-2026-33414, where the podman machine init --image command when run on Windows using the Hyper-V backend can run PowerShell-escaped commands from the user-specified image path on in a PowerShell session on the host (GHSA-hc8w-h2mf-hp59).

Bugfixes

Fixed a bug where containers with the unless-stopped restart policy would not restart after a reboot when podman-restart.service was enabled (#28152).

Fixed a bug where setting Entrypoint="" in a Quadlet .container file did not clear the container's entrypoint (#28213).

Fixed a bug where setting a HealthCmd in a Quadlet .container file to a command that included double-quotes (") would result in a nonfunctional healthcheck due to a parsing issue (#28409).

Fixed a bug where FreeBSD systems could panic when inspecting containers created with the host network mode (#28289).

API

Fixed a bug where the Libpod System Check endpoint could perform operations with bad data after returning a 400 error (#28350).

Fixed a bug where the remote attach API for containers (Libpod & Compat) could panic due to a rare race condition (#28277).

Fixed a bug where the Secret Create API could not create functional secrets using the shell driver due to options from the default driver being improperly added.

Misc

Updated Buildah to v1.43.1

Updated the containers/common library to v0.67.1

Updated the containers/image library to v5.39.2

Original source

Bugfixes

Fixed a critical bug where automatic migration from BoltDB to SQLite after a reboot could perform a partial migration, with some containers in SQLite and some remaining in BoltDB, when Quadlets were in use (#28215). For those who encountered this bug with 5.8.0 there is no way to automatically recover. If you do not have persistent containers/pods/volumes (i.e. all containers are run using Quadlets) then the easiest option is to move the db.sql file in Podman's storage directory to db.sql.bak (or similar) and reboot again with v5.8.1 to attempt another migration. Please contact the maintainers with any issues during migration and we will assist as able.

Original source

Features

The podman quadlet install command can now install files which contain multiple separate Quadlet files. The files must be separated with a --- delimeter on a new line, and each section must begin with a # FileName=<name> line to name the new Quadlet (#27384).

Quadlet .container files now support a new key, AppArmor, for configuring the container's AppArmor profile (#27095).

When running the podman artifact add command against a podman machine VM, if the path being loaded or built is shared into the VM, Podman will load it from the VM's filesystem instead of streaming the data through the REST API, improving performance (#26321).

The podman update command now features a new option, --ulimit, to update container ulimits (#26381).

The podman exec command now features a new option, --no-session, which disables tracking of the exec session to improve performance and startup time (#26588).

Changes

Podman will now automatically attempt to migrate legacy BoltDB databases to SQLite when the system reboots. This is necessary as support for BoltDB will be removed in Podman 6.0 in May. If automatic migration is not possible, a new option, podman system migrate --migrate-db, will manually force a migration.

The podman secret create - command no longer requires that the secret be provided through a pipe, and instead allows typing the secret through the terminal (#27879).

Bugfixes

Fixed a bug where containers created by podman play kube with a healthcheck using the initialDelaySeconds option would run healthchecks before the initial delay had expired (#27678).

Fixed a bug where healthchecks would sometimes fail to execute due to systemd rate limits.

Fixed a bug where the podman export command would emit a Mount event instead of an Export event.

Fixed a bug where the podman kube play command incorrectly handled precedence between environment variables set by both the envFrom and env fields (#27287).

Fixed a bug where the podman kube play command would panic when parsing Pod YAML missing the image field (#27784).

Fixed a bug where the podman volume mount command returned empty paths when volumes were handled by a plugin driver (#27858).

Fixed a bug where containers created with --rootfs instead of from an image would show that they had a healthcheck in the starting state even if no healthcheck was defined (#27651).

Fixed a bug where the podman build command's --pull=newer option did not function correctly (#22845).

Fixed a bug where the RequiresMountsFor field in Quadlet .container files incorrectly handled bind-mount paths which contained spaces.

Fixed a bug where the remote Podman client's podman run --detach-keys option did not accept an empty string (IE, no detach keys) (#27414).

Fixed a bug where the remove Podman client's podman build --secret ... env=VAR option would incorrectly try to read the environment variable on the server side, instead of from the client (#27494).

Fixed a bug where the podman artifact push and podman artifact pull commands ignored authentication credentials given by the --authfile option (#27421).

Fixed a bug where Windows paths were incorrectly handled under some circumstances when using the HyperV machine provider (#27571).

Fixed a bug where the podman run --pod-id-file option was not properly validated, allowing the creation of containers in pods with improper user namespace configuration (#26848).

API

Added new APIs for interacting with Quadlets, including GET /libpod/quadlets/{name}/file (print contents of a Quadlet file), GET /libpod/quadlets/{name}/exists (check if the given Quadlet exists), POST /libpod/quadlets (install one or more Quadlets), DELETE /libpod/quadlets (remove one or more Quadlets), and DELETE /libpod/quadlets/{name} (remove a single Quadlet).

Fixed a bug where the Compat and Libpod Logs endpoints for Containers did not use nanosecond-level precision for reported timestamps (#27961).

Fixed a bug where the Compat Create endpoint for Containers incorrectly handled healthcheck commands with arguments containing spaces (#26519).

Fixed a bug where the Compat Remove endpoint for Secrets was misnamed as DELETE /secret/{name} instead of DELETE /secrets/{name} (#27548).

Misc

Updated Buildah to v1.43.0

Updated the containers/storage library v1.62.0

Updated the containers/image library to v5.39.1

Updated the containers/common library to v0.67.0

Original source

Features

The podman quadlet install command can now install files which contain multiple separate Quadlet files. The files must be separated with a --- delimeter on a new line, and each section must begin with a # FileName=<name> line to name the new Quadlet (#27384).

Quadlet .container files now support a new key, AppArmor, for configuring the container's AppArmor profile (#27095).

When running the podman artifact add command against a podman machine VM, if the path being loaded or built is shared into the VM, Podman will load it from the VM's filesystem instead of streaming the data through the REST API, improving performance (#26321).

The podman update command now features a new option, --ulimit, to update container ulimits (#26381).

The podman exec command now features a new option, --no-session, which disables tracking of the exec session to improve performance and startup time (#26588).

Changes

The podman secret create - command no longer requires that the secret be provided through a pipe, and instead allows typing the secret through the terminal (#27879).

Bugfixes

Fixed a bug where containers created by podman play kube with a healthcheck using the initialDelaySeconds option would run healthchecks before the initial delay had expired (#27678).

Fixed a bug where healthchecks would sometimes fail to execute due to systemd rate limits.

Fixed a bug where the podman export command would emit a Mount event instead of an Export event.

Fixed a bug where the podman kube play command incorrectly handled precedence between environment variables set by both the envFrom and env fields (#27287).

Fixed a bug where the podman kube play command would panic when parsing Pod YAML missing the image field (#27784).

Fixed a bug where the podman volume mount command returned empty paths when volumes were handled by a plugin driver (#27858).

Fixed a bug where containers created with --rootfs instead of from an image would show that they had a healthcheck in the starting state even if no healthcheck was defined (#27651).

Fixed a bug where the podman build command's --pull=newer option did not function correctly (#22845).

Fixed a bug where the RequiresMountsFor field in Quadlet .container files incorrectly handled bind-mount paths which contained spaces.

Fixed a bug where the remote Podman client's podman run --detach-keys option did not accept an empty string (IE, no detach keys) (#27414).

Fixed a bug where the remove Podman client's podman build --secret ... env=VAR option would incorrectly try to read the environment variable on the server side, instead of from the client (#27494).

Fixed a bug where the podman artifact push and podman artifact pull commands ignored authentication credentials given by the --authfile option (#27421).

Fixed a bug where Windows paths were incorrectly handled under some circumstances when using the HyperV machine provider (#27571).

Fixed a bug where the podman run --pod-id-file option was not properly validated, allowing the creation of containers in pods with improper user namespace configuration (#26848).

API

Added new APIs for interacting with Quadlets, including GET /libpod/quadlets/{name}/file (print contents of a Quadlet file), GET /libpod/quadlets/{name}/exists (check if the given Quadlet exists), POST /libpod/quadlets (install one or more Quadlets), DELETE /libpod/quadlets (remove one or more Quadlets), and DELETE /libpod/quadlets/{name} (remove a single Quadlet).

Fixed a bug where the Compat and Libpod Logs endpoints for Containers did not use nanosecond-level precision for reported timestamps (#27961).

Fixed a bug where the Compat Create endpoint for Containers incorrectly handled healthcheck commands with arguments containing spaces (#26519).

Fixed a bug where the Compat Remove endpoint for Secrets was misnamed as DELETE /secret/{name} instead of DELETE /secrets/{name} (#27548).

Original source

Last week we released Podman 5.6 and I wanted to provide an update on the Apple Rosetta situation I discussed in my June blog post.

Current Status

As we indicated in June, Podman 5.6 ships with Rosetta disabled by default due to the compatibility issues between Rosetta and Linux kernels 6.13 and above. This means users will be using QEMU for architecture translation which is not as performant as Rosetta in many situations. However, we are happy to confirm that Apple has fixed the problem in their Tahoe beta.

Rosetta with the Tahoe Beta

We have confirmed that Apple has addressed the underlying compatibility issues between Rosetta and newer Linux kernels in macOS Tahoe beta. For users willing to run beta software, it is now possible to manually re-enable Rosetta functionality.

If you have updated Podman to 5.6 but have not updated your Podman machine image, then things should continure to work as before. The incompatibility only comes into effect when you pull and a run the newer machine image because it has a newer kernel.

Enabling Rosetta on Tahoo

For those running macOS Tahoe beta with Podman 5.6, the following steps will restore Rosetta:

Prerequisites

• macOS Tahoe beta installed
• Podman 5.6 with the “applehv” provider
• Podman 5.6 machine image.

Steps

1. Start your Podman machine:

   podman machine start

2. SSH into the machine and create the Rosetta enablement file:

   podman machine ssh "sudo touch /etc/containers/enable-rosetta"

3. Restart the Podman machine:

   podman machine stop

   podman machine start

4. Verify Rosetta is enabled:

   podman machine ssh "cat /proc/sys/fs/binfmt_misc/rosetta"

If Apple is able to fix the Rosetta problem in Sequoia (15), we will update users and determine a path forward for rosetta re-enablement.

Brent Baude, Podman Architect, Red Hat

Original source

We’re excited to announce the release of Podman 5.6, packed with significant new features and improvements that enhance the container management experience. This release brings substantial updates to Quadlet management, enhanced remote client capabilities, and numerous quality-of-life improvements.

Quadlet Management

One of the most significant additions in Podman 5.6 is the new suite of Quadlet management commands, making it easier than ever to work with systemd-style container units:

• podman quadlet install – Install new Quadlets for the current user
• podman quadlet list – List all installed Quadlets
• podman quadlet print – Display the contents of Quadlet files
• podman quadlet rm – Remove existing Quadlets

Enhanced Quadlet Configuration

These commands streamline Quadlet workflows, though they’re currently available only for local Podman installations (remote support coming in future releases).

Quadlet units have received significant functionality improvements across all unit types:

Container Units (.container)

• Environment variables can now be specified without values, automatically retrieving values from the host at runtime

Pod Units (.pod)

• New Label= key for setting pod labels
• New ExitPolicy= key for configuring pod exit behavior

Image Units (.image)

• New Policy= key to control pull policies (always pull, pull only if newer, etc.)

Network Units (.network)

• New InterfaceName= key to specify custom network interface names

Machine and Virtualization Enhancements

Swap Support

The podman machine init command now supports a --swap option, allowing you to enable and configure swap space in virtual machines with a specified size in megabytes.

Apple Silicon Improvements

For M3+ hosts running macOS 15+, nested virtualization is now enabled by default when using the libkrun provider, improving performance and compatibility.

Kubernetes Integration Improvements

Podman 5.6 brings enhanced Kubernetes compatibility with several podman kube play improvements:

• Resource Control: New annotations io.podman.annotations.cpuset/$ctrname and io.podman.annotations.memory-nodes/$ctrname allow precise CPU core and memory node restrictions
• Lifecycle Management: Support for lifecycle.stopSignal field in Pod YAML for custom container stop signals
• Empty Pod Support: Fixed handling of empty pods that previously caused failures

Enhancements to remote client

The remote Podman client has gained significant new capabilities, bringing it closer to feature parity with local installations:

• OCI Artifacts: Full podman artifact command suite for interacting with OCI artifacts
• Volume Operations: podman volume import and podman volume export commands
• Build Context: --build-context option support for podman build

New Command Options and Flexibility

Volume Creation

• New --uid and --gid options in podman volume create for setting ownership

Mount Enhancements

• --mount option now accepts dest= as an alias for destination=
• --mount type=artifact supports name= option for custom artifact filenames
• --tmpfs supports new noatime option for performance optimization

Docker Compatibility

Podman 5.6 introduces podman buildx inspect command, making it easier for users transitioning from Docker to maintain familiar workflows.

BoltDB deprecation

As part of ongoing improvements, Podman 5.6 includes warnings for installations still using the BoltDB database. BoltDB will be removed in Podman 6.0. While these warnings aren’t visible by default yet (coming in 5.7), users should begin using the new database backend.

Rosetta on Apple Silicon

Due to an incompatibility between the latest Linux kernels and Apple’s Rosetta, we had to disable Rosetta by default in Podman 5.6. Machine translation is still done by QEMU. See my blog for a summary of the Rosetta situation.

Get Podman 5.6

Podman 5.6 is available now through all standard distribution channels. For complete release notes, installation instructions, and detailed feature documentation, visit the official release page.

The OCI artifact commands are now considered stable, marking another milestone in Podman’s evolution as a comprehensive container management platform.

For more information about Podman 5.6 and detailed technical specifications, see the complete release notes on GitHub.

Original source

We’re excited to announce that Podman v4.7.0 has been released! This release includes over 40 features and over 30 bugfixes. Some highlights include:

• Modules feature on Linux: A module is a containers.conf file located at a specific directory. Stay tuned for an upcoming blog post explaining this feature in detail.
• Docker Compose bugfix: We fixed a bug with resource limits that caused Docker Compose to be unable to run containers due to being unable to set oom_score_adj when the most recent crun version was used as OCI runtime.
• Better Quadlet: Support for DNS, ShmSize, PidsLimit and Ulimit options.

For a full list of features, bugfixes and changes, check out the v4.7.0 release page.

Try it out and let us know what you think!

Original source