Podman command cheat sheet

Version, info and disk

podman --version

Client version. There is no server to ask, so this is the whole answer.

Full guide
bash Example session
```
$podman --versionpodman version 5.7.0
```
podman info

Everything about the local engine: runtime, network backend, store, rootless state.
podman info --format '{{.Host.OCIRuntime.Name}}'

One field from info. The runtime, network backend and rootless flag are the three worth knowing by heart.

Full guide
bash Example session
```
$podman info --format 'runtime={{.Host.OCIRuntime.Name}} network={{.Host.NetworkBackend}} rootless={{.Host.Security.Rootless}}'runtime=crun network=netavark rootless=true
```
podman info --format '{{.Store.GraphRoot}}'

Where images live. Under your home when rootless, /var/lib when not - the fastest way to tell which Podman you are talking to.

Full guide
bash Example session
```
$podman info --format 'store={{.Store.GraphRoot}} driver={{.Store.GraphDriverName}}'store=/home/sysadmin/.local/share/containers/storage driver=overlay
```

podman system df

Disk used by images, containers and volumes, and how much is reclaimable.

bash Example session

$podman system dfTYPE           TOTAL       ACTIVE      SIZE        RECLAIMABLEImages         4           0           183.7MB     183.7MB (100%)Containers     0           0           0B          0B (0%)Local Volumes  0           0           0B          0B (0%)

podman system migrate Caution

Rebuild the user namespace configuration after changing /etc/subuid or /etc/subgid.

Does not remove images. Needed because the mapping is cached in the store.
podman system reset Destructive

Delete every container, image, volume and network for this user.

Deliberately not executed for this sheet.

Images

podman images

List local images.

bash Example session

$podman imagesREPOSITORY                     TAG         IMAGE ID      CREATED       SIZEdocker.io/library/nginx        alpine      7bc5ba2f958a  2 days ago    64.2 MBdocker.io/library/redis        alpine      00c30ddf0ef8  3 days ago    119 MBdocker.io/library/alpine       latest      d529dd0c6e55  2 months ago  8.71 MBdocker.io/library/hello-world  latest      e2ac70e7319a  5 months ago  25.5 kB

podman images --format 'table {{.Repository}} {{.Tag}} {{.Size}}'

Just the columns you wanted.

bash Example session

$podman images --format 'table {{.Repository}} {{.Tag}} {{.Size}}'REPOSITORY                     TAG         SIZEdocker.io/library/nginx        alpine      64.2 MBdocker.io/library/redis        alpine      119 MBdocker.io/library/alpine       latest      8.71 MBdocker.io/library/hello-world  latest      25.5 kB

podman pull docker.io/library/alpine

Fetch an image. Write the registry out - Podman does not assume Docker Hub.

A bare `alpine` needs unqualified-search-registries configured, or it asks a question it cannot ask in a script.
podman image inspect alpine --format '{{.Digest}}'

The immutable digest. Pin this, not the tag, when it has to be the same image tomorrow.
bash Example session
```
$podman image inspect docker.io/library/alpine --format 'digest={{.Digest}} arch={{.Architecture}}'digest=sha256:79ff19e9084a00eece421b2523fb93e22d730e2c0e525905de047e848e56d95f arch=amd64
```
podman image tree alpine

Layers of an image and which other images share them.
podman tag SRC registry.example.com/team/app:1.4

Add a second name to an existing image. Costs nothing - a tag is a pointer.
podman push registry.example.com/team/app:1.4

Upload. Needs `podman login` first unless the registry is open.
podman save -o app.tar app:1.4

Write an image to a tar file, for moving it without a registry.
podman load -i app.tar

Read one back in.
podman rmi IMAGE Caution

Remove an image.

Fails while a container still references it; add -f to remove both.

Running containers

podman run -d --name web -p 8080:80 docker.io/library/nginx:alpine

Detached, named, with a published port. The everyday form.
bash Example session
```
$podman run -d --name cheat -p 8095:80 docker.io/library/nginx:alpinec7fadbd04987f5445d28aa1d4fec376ee79dddda86c3e6f9eab13a4782b5c55e
```
podman run --rm -it docker.io/library/alpine sh

Interactive shell that cleans up on exit.

podman run --rm docker.io/library/alpine id

One command, then gone. Note the uid: root inside is you outside.

Full guide

bash Example session

$podman run --rm docker.io/library/alpine iduid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel),11(floppy),20(dialout),26(tape),27(video)

podman ps

Running containers.

bash Example session

$podman psCONTAINER ID  IMAGE                           COMMAND               CREATED                 STATUS                 PORTS                 NAMESc7fadbd04987  docker.io/library/nginx:alpine  nginx -g daemon o...  Less than a second ago  Up Less than a second  0.0.0.0:8095->80/tcp  cheat

podman ps -a --pod

Everything, including stopped containers and which pod each is in.

Full guide
podman ps --format 'table {{.Names}} {{.Status}} {{.Ports}}'

The three columns that answer most questions.
bash Example session
```
$podman ps --format 'table {{.Names}} {{.Status}} {{.Ports}}'NAMES       STATUS       PORTScheat       Up 1 second  0.0.0.0:8095->80/tcp
```
podman stop web

SIGTERM, then SIGKILL after 10 seconds.

If it always takes 10 seconds, the process is not handling SIGTERM as PID 1.
bash Example session
```
$podman stop cheatcheat
```
podman restart web

Stop and start, keeping the container.
podman rm web Caution

Remove a stopped container.
bash Example session
```
$podman rm cheatcheat
```
podman start -a web

Start a stopped container and attach to its output.

Inspecting a running container

podman inspect web --format '{{.State.Pid}}'

The host PID of the container's process, which is what ps needs.

IPAddress is EMPTY for a rootless container on the default network - pasta gives it the host's interface rather than a bridge address.
bash Example session
```
$podman inspect cheat --format 'ip={{.NetworkSettings.IPAddress}} pid={{.State.Pid}}'ip= pid=4239
```

podman logs --tail 20 -f web

Recent output, then follow.

bash Example session

$podman logs --tail 3 cheat2026/08/22 11:20:30 [notice] 1#1: start worker processes2026/08/22 11:20:30 [notice] 1#1: start worker process 252026/08/22 11:20:30 [notice] 1#1: start worker process 26

podman exec -it web sh

A shell inside a running container.
podman exec web nginx -v

One command inside, no shell.
bash Example session
```
$podman exec cheat nginx -vnginx version: nginx/1.31.4
```
podman top web pid user comm

Processes as the container sees them - PID 1 is its entrypoint.

Full guide
bash Example session
```
$podman top cheat pid user commPID         USER        COMMAND1           root        nginx25          nginx       nginx26          nginx       nginx
```

podman stats --no-stream

CPU and memory once, rather than a live display.

bash Example session

$podman stats --no-stream --format 'table {{.Name}} {{.CPUPerc}} {{.MemUsage}}'NAME        CPU %       MEM USAGE / LIMITcheat       0.88%       3.281MB / 3.564GB

podman diff web

What the container changed relative to its image. A for added, C for changed.

bash Example session

$podman diff cheatC /etcC /etc/nginx/conf.dC /etc/nginx/conf.d/default.confA /run/nginx.pidC /var/cache/nginxC /varC /var/cacheA /var/cache/nginx/client_tempA /var/cache/nginx/fastcgi_tempA /var/cache/nginx/proxy_tempA /var/cache/nginx/scgi_tempA /var/cache/nginx/uwsgi_temp

podman port web

Published ports for this container.

Full guide
bash Example session
```
$podman port cheat80/tcp -> 0.0.0.0:8095
```
podman healthcheck run web

Run the container's health check once and print the result, instead of waiting for the interval.

Full guide

Pods

podman pod create --name app -p 8080:80

Create a pod. Ports go HERE, not on the containers.

Full guide
bash Example session
```
$podman pod create --name web -p 8080:804d919ca8a0e9ab39fbc7b834fe526dfdf8ad73794f9309cbb39cc55e5d2fe46e
```

podman pod ps

Pods, with a container count that includes the infra container.

Full guide

bash Example session

$podman pod psPOD ID        NAME        STATUS      CREATED                 INFRA ID      # OF CONTAINERS395e6c497abb  demo        Created     Less than a second ago  cab9c5ff3ef5  1

podman run -d --pod app --name web docker.io/library/nginx:alpine

Add a container to an existing pod.

Adding -p here fails: network configuration belongs to the pod.
podman pod inspect app --format '{{.SharedNamespaces}}'

Which namespaces the pod shares. The answer is uts, ipc and net - not pid, not mnt.

Full guide
bash Example session
```
$podman pod inspect demo --format 'shared={{.SharedNamespaces}}'shared=[uts ipc net]
```
podman pod stop app

Stop every container in the pod.
podman pod rm -f app Caution

Remove a pod and its containers. Quieter than kube down.

Full guide
bash Example session
```
$podman pod rm -f twinfbe4ad83cb00d73d2b17ddf0f25ae039cacb0cbab48bf31430144935c08fbf54
```
podman pod create --share pid,uts,ipc,net

Share the PID namespace too, so containers can see each other's processes.

Be deliberate: it also lets one container signal another's processes.

Kubernetes YAML

podman kube generate app

Export a running pod as a Kubernetes manifest.

Full guide

bash Example session

$podman kube generate shop# Save the output of this file and use kubectl create -f to import# it into Kubernetes.## Created with podman-5.7.0apiVersion: v1kind: Podmetadata:  annotations:    io.kubernetes.cri-o.SandboxID/cache: 2d5e8d85ede5aa9e0de6841ad6efb3d95f3e0fd3f22da34ca66f4dc84d781695    io.kubernetes.cri-o.SandboxID/storefront: 2d5e8d85ede5aa9e0de6841ad6efb3d95f3e0fd3f22da34ca66f4dc84d781695  creationTimestamp: "2026-08-22T11:08:24Z"  labels:    app: shop  name: shop

podman kube generate app -f app.yaml

Same, written to a file.
podman kube generate --type deployment app

Wrap the pod spec in a Deployment instead of a bare Pod.

podman kube play app.yaml

Run a manifest with no cluster. Container names come back prefixed with the pod name.

Full guide

bash Example session

$podman kube play shop.yamlPod:91a48f41701aea32709524af38796565f8aa865927d027cfad7f322e337134b2Containers:edd8357786aef2751997b473b79cb2b72e09d839668be44fafabca933af07cef5d392f6ec1f390b903dc58dd1d364d6a8b719829d49ffbc74fccc23b9c476ccf

podman kube play --replace app.yaml

Tear down and recreate in one step, instead of failing on an existing pod.

podman kube down app.yaml Caution

Remove what a manifest created.

Prints a rootless netns error and exits 0 anyway. Check $?, not the text.

Full guide

bash Example session

$podman kube down shop.yamlPods stopped:Error: stopping container a5cb6d4e001ba8035d2f3eee8e8fa777d00135c9589b7dc5e59b1ac621fe4574: removing container a5cb6d4e001ba8035d2f3eee8e8fa777d00135c9589b7dc5e59b1ac621fe4574 network: 1 error occurred:	* rootless netns: kill network process: permission denied  Pods removed:b3063debdee5129b9960376fa8cc4c0aacfcd7cc45fb131bffbdf05eb32159b3Secrets removed:Volumes removed:

podman kube play dep.yaml

A Deployment plays, but replicas above 1 are reduced to 1 with a warning - Podman is not a scheduler.

Full guide

bash Example session

$podman kube play dep.yamltime="2026-08-22T11:09:34Z" level=warning msg="Limiting replica count to 1, more than one replica is not supported by Podman"Pod:c01315c6a04eb89312c3d4f034f7d842df4f12eb26d0b9aa5c7447a0f5cfe1e0Container:bd394b71b07744a35a8bad14b7c7fd7f394804cd44e743cb588046b67c98bac0

podman kube play svc.yaml

Service and StatefulSet are refused by name. Supported kinds: Pod, Deployment, DaemonSet, Job, PVC, ConfigMap, Secret.

Full guide
bash Example session
```
$podman kube play svc.yamlError: YAML document does not contain any supported kube kind[exit 125]
```

Networks

podman network ls

Networks, including any created by kube play.

bash Example session

$podman network lsNETWORK ID    NAME                         DRIVER2f259bab93aa  podman                       bridge004c548118fa  podman-default-kube-network  bridge

podman network inspect podman --format '{{.Subnet}}'

The default bridge subnet, which is 10.88.0.0/16 rather than Docker's 172.17.
bash Example session
```
$podman network inspect podman --format 'driver={{.Driver}} subnet={{range .Subnets}}{{.Subnet}}{{end}}'driver=bridge subnet=10.88.0.0/16
```
podman network create appnet

A user-defined network, which gets container name resolution via aardvark-dns.
podman run --network appnet ...

Attach a container to it. On a user-defined network, containers resolve each other by name.
podman network rm appnet Caution

Remove it.
sudo sysctl net.ipv4.ip_unprivileged_port_start=80 Caution

Allow a rootless container to publish a port below 1024.

Host-wide, and it lets any unprivileged process bind those ports.

Volumes and mounts

podman volume create data

A named volume.
bash Example session
```
$podman volume create cheatvolcheatvol
```
podman volume ls

List volumes.
bash Example session
```
$podman volume lsDRIVER      VOLUME NAMElocal       cheatvol
```
podman volume inspect data --format '{{.Mountpoint}}'

Where it actually is on disk - under your home when rootless.
bash Example session
```
$podman volume inspect cheatvol --format 'mount={{.Mountpoint}}'mount=/home/sysadmin/.local/share/containers/storage/volumes/cheatvol/_data
```
podman run -v data:/var/lib/app ...

Mount a named volume.
podman run -v ~/src:/src ...

Bind mount a host directory.

Files the container's root writes land owned by YOUR uid outside.

Full guide
podman run --userns=keep-id -v ~/src:/src ...

Map your uid to the same uid inside, so a non-root container process can write to your files.
podman unshare rm -rf ./dir Destructive

Delete files owned by a subordinate uid, from inside the namespace where you own them.
podman volume rm data Destructive

Remove a volume and its contents.
bash Example session
```
$podman volume rm cheatvolcheatvol
```

Building

podman build -t app:1.4 .

Build from a Containerfile, or a Dockerfile if that is what is there.

This is a front end to buildah.
podman build --no-cache -t app:1.4 .

Ignore cached layers.
podman build --target builder -t app:build .

Stop at one stage of a multi-stage build.
podman build --platform linux/arm64 -t app:arm .

Build for another architecture, given emulation.
buildah from docker.io/library/alpine

Start a working container to build up by hand, with no Containerfile.

Systemd and Quadlet

systemctl --user enable --now podman.socket

Serve the Docker-compatible API, which is what real docker-compose needs.

Full guide
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock

Point Docker tooling at that socket.
loginctl enable-linger $USER

Keep your user's systemd instance running after logout, so rootless services survive it.

Without this, a rootless container started as a user service stops when your last session ends.
systemctl --user daemon-reload

Regenerate units after adding a Quadlet file.
podman auto-update Caution

Pull newer images for containers labelled io.containers.autoupdate=registry and restart them.

Cleanup

podman system prune -f Caution

Remove stopped containers, unused networks and dangling images.
bash Example session
```
$podman system prune -fDeleted Networkspodman-default-kube-networkTotal reclaimed space: 0B
```
podman system prune -a --volumes -f Destructive

The same, plus every unused image and volume.

--volumes is the part that loses data. Check `podman volume ls` first.
podman container prune -f Caution

Stopped containers only.
podman image prune -f Caution

Dangling images only.

When something is wrong

podman events --since 10m --stream=false

One timeline of creates, starts, deaths and pulls. The first place to look when something restarted and you do not know why.

bash Example session

$podman events --since 2m --stream=false --format '{{.Type}} {{.Status}} {{.Name}}'system refreshcontainer create cheatcontainer init cheatcontainer start cheatimage pull docker.io/library/nginx:alpinecontainer exec cheatcontainer exec_died cheatcontainer exec_died cheatvolume create cheatvol

podman inspect web --format '{{.State.ExitCode}} {{.State.Error}}'

Why a container stopped.
pgrep -a conmon

One monitor process per running container. No conmon, no container.

Full guide

pstree -sp $(pgrep conmon | head -1)

Proof there is no daemon: conmon's parent is PID 1.

Full guide

bash Example session

$pstree -sp $(pgrep conmon | head -1)systemd(1)---conmon(4859)---nginx(4861)-+-nginx(4886)                                        `-nginx(4887)

podman logs --since 5m web

Recent output only.
podman run --log-level debug ...

Verbose engine logging for a single command.
hash -r

Clear the shell's cached command lookups, when podman was just installed and 'command not found' persists.

Full guide