Podman Basics: Rootless Containers and Quadlets

Podman is the container engine that treats rootless operation as the norm rather than an afterthought. Instead of a daemon holding containers, Podman forks one process per container, and a user without sudo can run, build, and inspect images safely. When you pair it with Quadlet — Podman's native systemd unit generator — your containers become first-class units with start, restart, and log behaviour exactly like any other service.

On a single Netbay VPS, that combination gives you most of the resilience of an orchestrator with almost none of its machinery. This post walks rootless Podman and then Quadlets.

Rootless Containers: How They Stay Safe

A rootless container runs as an unprivileged user. Inside the user namespace, the container thinks it has root (UID 0 mapping to your unprivileged UID outside), but it cannot touch other users' files or open privileged ports without extra setup. Podman uses slirp4netns for networking and fuse-overlayfs for storage — both work fine on a normal Linux host.

# no sudo anywhere
podman pull nginx:alpine
podman run -d --name web -p 8080:80 nginx:alpine
podman ps
curl -s http://127.0.0.1:8080 >/dev/null && echo up

The mapping inside a user namespace makes the container's root harmless outside it.

Networking nuance: a rootless container cannot bind ports below 1024. Expose port 8080 and reverse-proxy it, or set net.ipv4.ip_unprivileged_port_start=80 on the host. Keep the rootless default whenever you can — it shrinks the blast radius of any container bug.

Quadlet: Containers as systemd Units

Quadlet reads small .container files from ~/.config/containers/systemd/ and converts them into systemd units. Now systemctl --user or a system unit manages your container exactly like any other service: restart on failure, start on boot, and unified logging via journalctl.

[Unit]
Description=Web service container

[Container]
Image=docker.io/library/nginx:alpine
PublishPort=8080:80
Volume=/srv/web/data:/usr/share/nginx/html:ro

[Service]
Restart=always
RestartSec=5

[Install]
WantedBy=default.target

Enable it:

mkdir -p ~/.config/containers/systemd
cp web.container ~/.config/containers/systemd/
systemctl --user daemon-reload
systemctl --user enable --now web
journalctl --user -u web -f

Because the unit is a systemd type, Restart=always plus RestartSec gives you self-healing out of the box, and journalctl gives you logs without a separate log driver.

Files and Storage Under the Hood

Rootless storage lives in ~/.local/share/containers and ~/.config/containers manages your registries and networks. A quick inspection toolchain keeps you oriented:

podman images
podman volume ls
podman network ls
podman system df
podman stats

Takeaway

Rootless Podman plus Quadlet gives you containerized services that behave like normal systemd units — a good middle ground between hand-rolled scripts and a full cluster. On a Netbay VPS, use it to run your app, database, and a reverse proxy each as a managed service. Provision a fresh instance at netbayhosts.in, and systemd will pull these containers up on every boot.