Podman containers cheat sheet

The chapter on one page: what to remember, the commands to have at your fingertips, and flashcards for quick revision.

The chapter in eight sentences

A container is a set of ordinary processes started from an image and isolated from the rest of the system; Podman runs them without a daemon and, by default, without root.
Pull images by their full name (registry.access.redhat.com/ubi9/...); a tag can move, a digest cannot.
A container lives as long as its main process; podman ps -a, podman logs and podman exec explain what happened.
Rootless and root Podman have separate storage; root inside a container is only your own user outside.
-p HOST:CONTAINER publishes a port (rootless needs 1024 or higher), and the firewall must allow it for other hosts.
Keep data outside the container: -v DIR:/path:Z (the Z fixes the SELinux label) or a named volume.
A Containerfile (FROM, COPY, CMD) plus podman build -t localhost/name:1 . makes your own image.
A .container file in ~/.config/containers/systemd/ becomes a user service after systemctl --user daemon-reload; Restart=always restarts it and loginctl enable-linger starts it at boot.

Command	Does
`podman pull FULLNAME` · `podman images`	Get and list images
`podman run --rm IMAGE cmd`	One-off container
`podman run -d --name N -p 8080:8080 IMAGE`	Background container
`podman ps [-a]` · `podman logs N` · `podman exec N cmd`	Look inside
`podman stop -t 1 N` · `podman rm [-f] N` · `podman rmi IMAGE`	Stop and remove

Command	Does
`-v ~/web:/var/www/html:ro,Z`	Bind mount with private SELinux label
`podman volume create V` · `-v V:/data`	Named volume
`-e NAME=value`	Setting
`podman unshare ls -ln DIR`	Files as the container sees them
`podman build -t localhost/app:1 .`	Build from a Containerfile
`podman tag A B` · `podman history IMAGE`	Names and layers

Item	Does
`~/.config/containers/systemd/NAME.container`	Quadlet file
`[Container] Image= PublishPort= Volume=`	What to run
`[Service] Restart=always` · `[Install] WantedBy=default.target`	Policy
`systemctl --user daemon-reload` · `start NAME.service`	Generate and start
`journalctl _SYSTEMD_USER_UNIT=NAME.service`	Its log
`sudo loginctl enable-linger USER`	Start at boot
`sudo firewall-cmd --permanent --add-port=8080/tcp`	Let others in

Pull and list images?: podman pull FULLNAME · podman images
Run a one-off container?: podman run --rm IMAGE command
Run a service container?: podman run -d --name NAME -p 8080:8080 IMAGE
Look at running and stopped containers?: podman ps · podman ps -a · podman logs NAME · podman exec NAME cmd
Stop and remove?: podman stop NAME · podman rm NAME · podman rm -f NAME · podman rmi IMAGE
Publish a port?: -p HOST:CONTAINER (rootless: host port 1024 or higher); allow it in firewalld
Share a host directory?: -v ~/web:/var/www/html:ro,Z (Z = SELinux relabel, private)
Keep data in a volume?: podman volume create V · -v V:/data
Build an image?: Containerfile: FROM, COPY, CMD · podman build -t localhost/name:1 .
Quadlet file?: ~/.config/containers/systemd/web.container: [Container] Image= PublishPort= · [Service] Restart=always · [Install] WantedBy=default.target
Start a Quadlet service?: systemctl --user daemon-reload · systemctl --user start web.service
Survive a reboot without a login?: sudo loginctl enable-linger student