CertGrid CertGrid
Hands-on Lab·Podman

Inspecting Podman Containers

Four questions and the command for each: what has it said, what is it running, what is it costing, and what has it changed. `podman diff` is the one people never reach for and should.

Containers and Images Guide 8 of 47 Beginner

Written against the versions above. Podman follows the distribution here rather than a vendor repository, so the version you get is the one Ubuntu shipped. The commands are stable across 5.x.

Every command on this page ran on podman01.
Server NameIP AddressOSRolesCPURAMHDD
PODMAN01192.168.0.21Ubuntu 26.04 LTSPrimary Container Host2 Core4 GB50 GB

Before you start

  1. What has it said, and what is it running

    podman logs is whatever the container wrote to stdout and stderr. Not a file inside the container - the streams its PID 1 produced, which Podman captured. --tail 4 bounds it; -f follows; --since 5m is usually what you actually want.

    podman top is the process list as the container sees it. nginx is PID 1 with its workers as children, and the workers run as the nginx user while the master runs as root - inside the namespace. Compare with ps on the host, where all of them belong to your account (guide 3).

    The two answer different questions and people reach for logs when they wanted top. If the container is up but doing nothing, its logs may be silent while top shows you immediately whether the process is even there.

    bash Example session 
    podman logs --tail 4 site2026/08/22 11:35:41 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 524288:5242882026/08/22 11:35:41 [notice] 1#1: start worker processes2026/08/22 11:35:41 [notice] 1#1: start worker process 172026/08/22 11:35:41 [notice] 1#1: start worker process 18podman top site pid user commPID         USER        COMMAND1           root        nginx17          nginx       nginx18          nginx       nginx

    Expected resultFour nginx startup notices, then a process list with nginx as PID 1.

    Success conditionYou can see both what the container printed and what it is running.

  2. What is it costing

    podman stats --no-stream gives one sample and exits, which is what you want in a script or a note. Without the flag it takes over the terminal with a live display.

    The memory column reads 3.281MB / 3.564GB, and the limit is the interesting half: 3.564GB is the whole machine. No limit was set, so the container may use everything, and "the container is using 0.1% of memory" means 0.1% of the host.

    That is the honest reading of an unlimited container: it is not constrained, it just has not asked for much yet. Setting --memory changes the denominator to the limit, which is what makes the percentage mean anything.

    bash Example session 
    podman stats --no-stream --format 'table {{.Name}} {{.CPUPerc}} {{.MemUsage}}'NAME        CPU %       MEM USAGE / LIMITsite        0.60%       3.174MB / 3.564GB

    Expected resultOne row, with a memory limit equal to the host's total RAM.

    Success conditionYou can state what the percentage in a stats output is a percentage of.

  3. What has it changed

    podman diff compares the container's writable layer against the image it came from. It is the least-used command here and often the most useful.

    C /etc/nginx/conf.d/default.conf
A /run/nginx.pid
A /var/cache/nginx/client_temp

    A added, C changed, D deleted. Everything nginx has written since it started, and nothing else.

    Two things it is good for. Finding state you did not mean to keep: any file here is in the container's writable layer, which means it dies with podman rm and belongs in a volume if it matters. And answering "what did this thing do to itself" on a container that is misbehaving after a while - a diff listing a hundred files in /tmp tells you something is accumulating.

    It is also the honest check on whether a container is actually stateless, which is asserted far more often than it is verified.

    bash Example session 
    podman diff siteC /etcC /etc/nginx/conf.dC /etc/nginx/conf.d/default.confA /run/nginx.pidC /var/cache/nginxC /varC /var/cacheA /var/cache/nginx/client_tempA /var/cache/nginx/fastcgi_tempA /var/cache/nginx/proxy_tempA /var/cache/nginx/scgi_tempA /var/cache/nginx/uwsgi_temp

    Expected resultA dozen paths, each prefixed A or C.

    Success conditionYou have a list of every file the container has written since it started.

Troubleshooting

Official sources

← All Podman guides