CertGrid CertGrid
Concepts·Podman

Podman Pods and Infra Containers

`podman pod inspect` answers the question directly: `shared=[uts ipc net]`. Two containers in a pod share one hostname and one IP, and still cannot see each other's processes or files.

Pods Guide 11 of 47 Beginner

Written against the versions above. Podman follows the distribution here rather than a vendor repository, so the version you get is the one Ubuntu shipped. The commands are stable across 5.x.

Every command on this page ran on podman01.
Server NameIP AddressOSRolesCPURAMHDD
PODMAN01192.168.0.24Ubuntu 26.04 LTSPrimary Container Host2 Core4 GB50 GB

Before you start

  1. Create an empty pod and count the containers

    A pod with nothing in it is not empty. Create one, then list containers.

    There is already one - named -infra, Created, running nothing visible. podman pod ps reports # OF CONTAINERS: 1 before you have added any.

    This is the infra container, and it is the whole mechanism. It exists to hold a set of namespaces open. Containers you add later do not create namespaces of their own for the shared ones - they join this container's.

    bash Example session 
    podman pod create --name demo395e6c497abb01047486848cb993360471eb992b3ce5b0a41375e86b6a11462bpodman pod psPOD ID        NAME        STATUS      CREATED                 INFRA ID      # OF CONTAINERS395e6c497abb  demo        Created     Less than a second ago  cab9c5ff3ef5  1podman ps -a --podCONTAINER ID  IMAGE       COMMAND     CREATED                 STATUS      PORTS       NAMES               POD ID        PODNAMEcab9c5ff3ef5                          Less than a second ago  Created                 395e6c497abb-infra  395e6c497abb  demo

    Expected resultA pod in state Created with one container, which you did not add.

    Success conditionYou can name the container that exists in a pod you have put nothing into.

  2. Ask which namespaces are shared

    Do not infer this from the Kubernetes documentation - ask the pod:

    shared=[uts ipc net]

    Three, and it is worth being precise about each:

    • uts - the hostname. Every container in the pod answers hostname with the pod's name.
    • ipc - System V IPC and POSIX message queues. Shared memory between containers works.
    • net - one network namespace. One IP address, one set of interfaces, one port space, one loopback.

    What is not in that list matters just as much: pid and mnt. Processes and filesystems stay private. If you have carried over an assumption from Kubernetes that pod containers can see each other's processes, this is where to correct it - there it is opt-in too.

    bash Example session 
    podman pod inspect demo --format 'infra={{.InfraContainerID}}'infra=cab9c5ff3ef5f39daf8db290857e9477c8593e67b84e3ccf1032c78138c5b77apodman inspect $(podman pod inspect demo --format '{{.InfraContainerID}}') --format 'image={{.ImageName}} cmd={{.Config.Cmd}}'image= cmd=[]podman pod inspect demo --format 'shared={{.SharedNamespaces}}'shared=[uts ipc net]

    Expected resultshared=[uts ipc net], and an infra container with no user image.

    Success conditionYou have the list of shared namespaces from the pod itself, not from memory.

  3. Two containers, one network and one hostname

    Add two containers to the pod and ask each what its address and hostname are.

    The answers are identical. Same eth0, same IP, same hostname demo. Not similar - the same, because there is one network namespace and one UTS namespace between them.

    One detail that surprises people arriving from Docker: the address is 192.168.0.24/24, which is the host's own LAN address, not a private 172.17.x.x. That is rootless networking, where by default the container's interface mirrors the host's rather than sitting behind a bridge. It has its own guide in the Networking track; for now, just note that the two containers agree.

    bash Example session 
    podman run -d --pod demo --name alpha docker.io/library/alpine sleep 3006e1c21381610c4bbbd2ee23273c37e1b8514408b32a40ee2d4856c8b606b7b94podman run -d --pod demo --name beta docker.io/library/alpine sleep 3007e3f1d03320c152f5baa3afac820a84301b576c742fa4e1bc3f9dcdad5cc84c3podman pod psPOD ID        NAME        STATUS      CREATED                 INFRA ID      # OF CONTAINERS395e6c497abb  demo        Created     Less than a second ago  cab9c5ff3ef5  1podman exec alpha ip -o addr show eth02: eth0    inet 192.168.0.24/24 brd 192.168.0.255 scope global eth0\       valid_lft forever preferred_lft forever2: eth0    inet6 fe80::c8dd:a1ff:fe31:e9fc/64 scope link flags 02 \       valid_lft forever preferred_lft foreverpodman exec beta ip -o addr show eth02: eth0    inet 192.168.0.24/24 brd 192.168.0.255 scope global eth0\       valid_lft forever preferred_lft forever2: eth0    inet6 fe80::c8dd:a1ff:fe31:e9fc/64 scope link flags 02 \       valid_lft forever preferred_lft foreverpodman exec alpha hostnamedemopodman exec beta hostnamedemo

    Expected resultThree containers in the pod, and two containers reporting the same address and the same hostname.

    Success conditionTwo containers give byte-identical answers about the network they are on.

  4. Now prove what is not shared

    The same two containers, asked about processes and files.

    Processes: each sees PID 1 running its own sleep. Two different processes, both numbered 1, because each container has its own PID namespace. Neither can see the other's.

    Files: write a file to /tmp in alpha, then list /tmp in beta. It is empty. The mount namespace is private, so /tmp is a different directory in each container despite the shared network.

    This is the accurate mental model, and it is narrower than most people assume: a pod is a shared network identity, not a shared machine. Containers in a pod talk over localhost, not over the filesystem. If two containers need to share files, they need a volume - the pod does not give them one.

    bash Example session 
    podman exec alpha ps -eo pid,commPID   COMMAND    1 sleep    4 pspodman exec beta ps -eo pid,commPID   COMMAND    1 sleep    4 pspodman exec alpha sh -c 'echo hello > /tmp/from-alpha; ls /tmp'from-alphapodman exec beta ls /tmppodman pod rm -f demotime="2026-08-22T11:02:57Z" level=warning msg="StopSignal SIGTERM failed to stop container alpha in 10 seconds, resorting to SIGKILL"time="2026-08-22T11:02:57Z" level=warning msg="StopSignal SIGTERM failed to stop container beta in 10 seconds, resorting to SIGKILL"395e6c497abb01047486848cb993360471eb992b3ce5b0a41375e86b6a11462b

    Expected resultTwo separate PID 1s, and a file visible in one container and absent in the other.

    Success conditionYou can state what a pod shares and what it does not, having tested both.

Troubleshooting

Official sources

← All Podman guides