How to Install and Configure Podman on Ubuntu 24.04 LTS for Rootless Containers

Docker has long been the dominant container runtime for Linux servers. However, Docker’s traditional architecture relies on a persistent root-level daemon (dockerd) that introduces single-point-of-failure risks and security concerns when containers require privileged system access. Podman (Pod Manager) is a modern, open-source container engine developed by Red Hat that is entirely daemonless and runs containers in rootless mode by default. On Ubuntu 24.04 LTS (Noble Numbat), Podman offers a production-ready, drop-in replacement for Docker with native OCI compatibility and Kubernetes pod primitives.

Key Advantages of Podman Over Traditional Docker

Switching to Podman on Ubuntu server infrastructure delivers distinct operational benefits:

• Daemonless Architecture: Podman operates via the Linux fork/exec model. When you run a container, Podman spawns conmon to monitor the container process directly, eliminating memory-heavy background daemons.
• Rootless by Design: Unprivileged users can pull, build, run, and manage containers without needing sudo or membership in a privileged system group. Even if a container is compromised, the attacker only has standard unprivileged user permissions on the host.
• Docker CLI Drop-In Alias: Podman shares full CLI parity with Docker syntax; typing podman run, podman ps, and podman build behaves identically to Docker commands.
• Native Pod Support: Group multiple containers into shared network namespaces (pods) matching Kubernetes resource specifications.

Installing Podman on Ubuntu 24.04 LTS

Ubuntu 24.04 includes native Podman packages in its official universe repositories:

# Update repository index
sudo apt update

# Install Podman along with recommended container tools
sudo apt install -y podman buildah skopeo

# Verify installation and version
podman --version
podman info

Configuring Subordinate UID and GID Mappings for Rootless Execution

Rootless containerization requires allocating subuid and subgid ranges so the Linux kernel can map user IDs within the container namespace to unused unprivileged IDs on the host:

1. Verify that your active user has an allocated range in /etc/subuid and /etc/subgid:

   cat /etc/subuid
   cat /etc/subgid

2. If your username is missing from these files, append a standard 65,536-ID subordinate allocation:

   sudo usermod --add-subuids 100000-165535 $USER
   sudo usermod --add-subgids 100000-165535 $USER

3. Update your user namespace configuration:

   podman system migrate

Running and Managing Containers as a Standard User

Without prepending sudo, execute standard container commands directly:

Command	Operation Description
podman run -d --name web -p 8080:80 nginx:alpine	Launches a background Nginx container mapped to unprivileged host port 8080.
podman ps -a	Lists all active and stopped container instances.
podman logs -f web	Streams real-time container log output.
podman generate systemd --new --files --name web	Generates standard systemd unit files to manage container lifecycle automatically.

Creating a Seamless Docker Alias

To maintain muscle memory and ensure legacy developer scripts work without modification:

# Add alias to your shell profile
echo 'alias docker=podman' >> ~/.bashrc
source ~/.bashrc

# Test alias execution
docker run --rm hello-world

Enabling Container Auto-Start on System Boot for Non-Root Users

By default, user systemd services stop when a user logs out of their SSH session. To allow rootless containers to start on system boot and persist indefinitely:

# Enable linger for your user account
sudo loginctl enable-linger $USER

# Move systemd unit file to user directory
mkdir -p ~/.config/systemd/user/
mv container-web.service ~/.config/systemd/user/

# Reload user daemon and enable service
systemctl --user daemon-reload
systemctl --user enable --now container-web.service