Change MTU for rootless containers

[volker-raschek]

Hi,
I am experiencing an issue where the MTU of the default podman network is 65520, which causes connection drops.

After a deeper analysis, I found that if I create a custom network with an MTU of 1500, the connection drops do not occur. The question I have is: How can I set the MTU to 1500 for both root and rootless containers?

I tried to solve the problem myself. I edited the file /etc/containers/containers.conf, defined slirp4netns as the default_rootless_network_cmd, and added --mtu=1500 to engine.network_cmd_options.

When I start a container as root, I see that the MTU is correctly set to 1500:

$ sudo podman run --rm docker.io/library/busybox:latest ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: eth0@if20: <BROADCAST,MULTICAST,UP,LOWER_UP,M-DOWN> mtu 1500 qdisc noqueue qlen 1000
    link/ether 06:1a:8b:1d:2c:b5 brd ff:ff:ff:ff:ff:ff

However, running the same command without sudo results in the following error:

$ podman run --rm docker.io/library/busybox:latest ip link show
Error: unknown option for slirp4netns: "--mtu=1500"

When I run slirp4netns now, I see that there is a --mtu flag, which has the default of MTU 1500, but seems to be set by podman. I don't understand why podman has a problem with this option, when I configure it via containers.conf to restore it's default behavior. Can anyone help me with this? I can't solve this problem on my own.

$ slirp4netns -h
Usage: slirp4netns [OPTION]... PID|PATH|FD [TAPNAME]
User-mode networking for unprivileged network namespaces.

-c, --configure          bring up the interface
-e, --exit-fd=FD         specify the FD for terminating slirp4netns
-r, --ready-fd=FD        specify the FD to write to when the network is configured
-m, --mtu=MTU            specify MTU (default=1500, max=65521)
-6, --enable-ipv6        enable IPv6 (experimental)
-a, --api-socket=PATH    specify API socket path
--cidr=CIDR              specify network address CIDR (default=10.0.2.0/24)
--disable-host-loopback  prohibit connecting to 127.0.0.1:* on the host namespace
--netns-type=TYPE 	 specify network namespace type ([path|pid|tapfd], default=pid)
--userns-path=PATH	 specify user namespace path
--enable-sandbox         create a new mount namespace (and drop all caps except CAP_NET_BIND_SERVICE if running as the root)
--enable-seccomp         enable seccomp to limit syscalls (experimental)
--outbound-addr=IPv4     sets outbound ipv4 address to bound to (experimental)
--outbound-addr6=IPv6    sets outbound ipv6 address to bound to (experimental)
--disable-dns            disables 10.0.2.3 (or configured internal ip) to host dns redirect (experimental)
--macaddress=MAC         specify the MAC address of the TAP (only valid with -c)
--target-type=TYPE       specify the target type ([netns|bess], default=netns)
-h, --help               show this help and exit
-v, --version            show version and exit

Here is some additional information:

host:
  arch: amd64
  buildahVersion: 1.42.2
  cgroupControllers:
  - memory
  - pids
  cgroupManager: systemd
  cgroupVersion: v2
  conmon:
    package: conmon-1:2.1.13-1
    path: /usr/bin/conmon
    version: 'conmon version 2.1.13, commit: 82de887596ed8ee6d9b2ee85e4f167f307bb569b'
  cpuUtilization:
    idlePercent: 97.79
    systemPercent: 0.44
    userPercent: 1.77
  cpus: 24
  databaseBackend: sqlite
  distribution:
    distribution: arch
    version: unknown
  eventLogger: journald
  freeLocks: 2048
  hostname: markus-pc
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 200000
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1000
      size: 1
    - container_id: 1
      host_id: 200000
      size: 65536
  kernel: 6.12.63-1-lts
  linkmode: dynamic
  logDriver: journald
  memFree: 28432691200
  memTotal: 67337887744
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    dns:
      package: aardvark-dns-1.17.0-1
      path: /usr/lib/podman/aardvark-dns
      version: aardvark-dns 1.17.0
    package: netavark-1.17.1-1
    path: /usr/lib/podman/netavark
    version: netavark 1.17.1
  ociRuntime:
    name: crun
    package: crun-1.25.1-1
    path: /usr/bin/crun
    version: |-
      crun version 1.25.1
      commit: 156ae065d4a322d149c7307034f98d9637aa92a2
      rundir: /run/user/1000/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +YAJL
  os: linux
  pasta:
    executable: /usr/bin/pasta
    package: passt-2025_12_23.2ba9fd5-1
    version: |
      pasta 2025_12_23.2ba9fd5
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /run/user/1000/podman/podman.sock
  rootlessNetworkCmd: slirp4netns
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /etc/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: /usr/bin/slirp4netns
    package: slirp4netns-1.3.3-1
    version: |-
      slirp4netns version 1.3.3
      commit: 944fa94090e1fd1312232cbc0e6b43585553d824
      libslirp: 4.9.1
      SLIRP_CONFIG_VERSION_MAX: 6
      libseccomp: 2.5.6
  swapFree: 31689011200
  swapTotal: 31689011200
  uptime: 3h 40m 56.00s (Approximately 0.12 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries: []
store:
  configFile: /home/markus/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: btrfs
  graphOptions: {}
  graphRoot: /home/markus/.local/share/containers/storage
  graphRootAllocated: 966367641600
  graphRootUsed: 360473034752
  graphStatus:
    Build Version: Btrfs v6.17.1
    Library Version: "104"
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 32
  runRoot: /run/user/1000/containers
  transientStore: false
  volumePath: /home/markus/.local/share/containers/storage/volumes
version:
  APIVersion: 5.7.1
  Built: 1765447754
  BuiltTime: Thu Dec 11 11:09:14 2025
  GitCommit: f845d14e941889ba4c071f35233d09b29d363c75
  GoVersion: go1.25.5 X:nodwarf5
  Os: linux
  OsArch: linux/amd64
  Version: 5.7.1

$ cat /etc/containers/containers.conf
# The containers configuration file specifies all of the available configuration
# command-line options/flags for container engine tools like Podman & Buildah,
# but in a TOML format that can be easily modified and versioned.

# Please refer to containers.conf(5) for details of all configuration options.
# Not all container engines implement all of the options.
# All of the options have hard coded defaults and these options will override
# the built in defaults. Users can then override these options via the command
# line. Container engines will read containers.conf files in up to three
# locations in the following order:
#  1. /usr/share/containers/containers.conf
#  2. /etc/containers/containers.conf
#  3. $XDG_CONFIG_HOME/containers/containers.conf or
#     $HOME/.config/containers/containers.conf if $XDG_CONFIG_HOME is not set
#  Items specified in the latter containers.conf, if they exist, override the
# previous containers.conf settings, or the default settings.

[containers]

# List of annotation. Specified as
# "key = value"
# If it is empty or commented out, no annotations will be added
#
#annotations = []

# Used to change the name of the default AppArmor profile of container engine.
#
#apparmor_profile = "container-default"

# Base file to create the `/etc/hosts` file inside the container. This must either
# be an absolute path to a file on the host system, or one of the following
# special flags:
# ""      Use the host's `/etc/hosts` file (the default)
# `none`  Do not use a base file (i.e. start with an empty file)
# `image` Use the container image's `/etc/hosts` file as base file
#
#base_hosts_file = ""

# List of cgroup_conf entries specifying a list of cgroup files to write to and
# their values. For example `memory.high=1073741824` sets the
# memory.high limit to 1GB.
#
# cgroup_conf = []

# Default way to to create a cgroup namespace for the container
# Options are:
# `private` Create private Cgroup Namespace for the container.
# `host`    Share host Cgroup Namespace with the container.
#
#cgroupns = "private"

# Control container cgroup configuration
# Determines  whether  the  container will create CGroups.
# Options are:
# `enabled`   Enable cgroup support within container
# `disabled`  Disable cgroup support, will inherit cgroups from parent
# `no-conmon` Do not create a cgroup dedicated to conmon.
#
#cgroups = "enabled"

# When no hostname is set for a container, use the container's name, with
# characters not valid for a hostname removed, as the hostname instead of
# the first 12 characters of the container's ID. Containers not running
# in a private UTS namespace will have their hostname set to the host's
# hostname regardless of this setting.
#
#container_name_as_hostname = false

# List of default capabilities for containers. If it is empty or commented out,
# the default capabilities defined in the container engine will be added.
#
#default_capabilities = [
#  "CHOWN",
#  "DAC_OVERRIDE",
#  "FOWNER",
#  "FSETID",
#  "KILL",
#  "NET_BIND_SERVICE",
#  "SETFCAP",
#  "SETGID",
#  "SETPCAP",
#  "SETUID",
#  "SYS_CHROOT",
#]

# A list of sysctls to be set in containers by default,
# specified as "name=value",
# for example:"net.ipv4.ping_group_range=0 0".
#
default_sysctls = [
  "net.ipv4.ping_group_range=0 0",
]

# A list of ulimits to be set in containers by default, specified as
# "<ulimit name>=<soft limit>:<hard limit>", for example:
# "nofile=1024:2048"
# See setrlimit(2) for a list of resource names.
# Any limit not specified here will be inherited from the process launching the
# container engine.
# Ulimits has limits for non privileged container engines.
#
#default_ulimits = [
#  "nofile=1280:2560",
#]

# List of devices. Specified as
# "<device-on-host>:<device-on-container>:<permissions>", for example:
# "/dev/sdc:/dev/xvdc:rwm".
# If it is empty or commented out, only the default devices will be used
#
#devices = []

# List of default DNS options to be added to /etc/resolv.conf inside of the container.
#
#dns_options = []

# List of default DNS search domains to be added to /etc/resolv.conf inside of the container.
#
#dns_searches = []

# Set default DNS servers.
# This option can be used to override the DNS configuration passed to the
# container. The special value "none" can be specified to disable creation of
# /etc/resolv.conf in the container.
# The /etc/resolv.conf file in the image will be used without changes.
#
#dns_servers = []

# Environment variable list for the conmon process; used for passing necessary
# environment variables to conmon or the runtime.
#
#env = [
#  "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
#]

# Pass all host environment variables into the container.
#
#env_host = false

# Set the IP address the container should expect to connect to the host. The IP
# address is used by Podman to automatically add the `host.containers.internal`
# and `host.docker.internal` hostnames to the container's `/etc/hosts` file. It
# is also used for the *host-gateway* flag of Podman's `--add-host` CLI option.
# If no IP address is configured (the default), Podman will try to determine it
# automatically, but might fail to do so depending on the container's network
# setup. Adding these internal hostnames to `/etc/hosts` is silently skipped then.
# Set this config to `none` to never add the internal hostnames to `/etc/hosts`.
#
# Note: If Podman is running in a virtual machine using `podman machine` (this
# includes Mac and Windows hosts), Podman will silently skip adding the internal
# hostnames to `/etc/hosts`, unless an IP address was configured manually. The
# internal hostnames are resolved by the gvproxy DNS resolver instead. This config
# has no effect on gvproxy. However, since `/etc/hosts` bypasses the DNS resolver,
# a manually configured IP address still takes precedence.
#
# Note: This config doesn't affect the actual network setup, it just tells Podman
# the IP address it should expect. Configuring an IP address here doesn't ensure
# that the container can actually reach the host using this IP address.
#
#host_containers_internal_ip = ""

# Default proxy environment variables passed into the container.
# The environment variables passed in include:
# http_proxy, https_proxy, ftp_proxy, no_proxy, and the upper case versions of
# these. This option is needed when host system uses a proxy but container
# should not use proxy. Proxy environment variables specified for the container
# in any other way will override the values passed from the host.
#
#http_proxy = true

# Run an init inside the container that forwards signals and reaps processes.
#
#init = false

# Container init binary, if init=true, this is the init binary to be used for containers.
# If this option is not set catatonit is searched in the directories listed under
# the helper_binaries_dir option. It is recommended to just install catatonit
# there instead of configuring this option here.
#
#init_path = "/usr/lib/podman/catatonit"

# Default way to to create an IPC namespace (POSIX SysV IPC) for the container
# Options are:
#  "host"     Share host IPC Namespace with the container.
#  "none"     Create shareable IPC Namespace for the container without a private /dev/shm.
#  "private"  Create private IPC Namespace for the container, other containers are not allowed to share it.
#  "shareable" Create shareable IPC Namespace for the container.
#
#ipcns = "shareable"

# Default way to set an interface name inside container. Defaults to legacy
# pattern of ethX, where X is a integer, when left undefined.
# Options are:
#  "device"   Uses the network_interface name from the network config as interface name.
#             Falls back to the ethX pattern if the network_interface is not set.
#interface_name = ""

# keyring tells the container engine whether to create
# a kernel keyring for use within the container.
#
#keyring = true

# label tells the container engine whether to use container separation using
# MAC(SELinux) labeling or not.
# The label flag is ignored on label disabled systems.
#
#label = true

# label_users indicates whether to enforce confined users in containers on
# SELinux systems. This option causes containers to maintain the current user
# and role field of the calling process. By default SELinux containers run with
# the user system_u, and the role system_r.
#label_users = false

# Logging driver for the container. Available options: k8s-file and journald.
#
#log_driver = "k8s-file"

# Default path for container logs to be stored in. When empty, logs will be stored
# in the container's default storage and removed when the container is removed.
# A subdirectory named with the container ID will be created under the specified
# path, and the log file will have the default name `ctr.log` within that directory.
# This option can be overridden by the `--log-opt` flag.
#
#log_path = ""

# Maximum size allowed for the container log file. Negative numbers indicate
# that no size limit is imposed. If positive, it must be >= 8192 to match or
# exceed conmon's read buffer. The file is truncated and re-opened so the
# limit is never exceeded.
#
#log_size_max = -1

# Specifies default format tag for container log messages.
# This is useful for creating a specific tag for container log messages.
# Containers logs default to truncated container ID as a tag.
#
#log_tag = ""

# List of mounts. Specified as
# "type=TYPE,source=<directory-on-host>,destination=<directory-in-container>,<options>", for example:
# "type=bind,source=/var/lib/foobar,destination=/var/lib/foobar,ro".
# If it is empty or commented out, no mounts will be added
#
#mounts = []

# Default way to create a NET namespace for the container.
# The option is mapped to the **--network** argument for the podman commands, it accepts the same values as that option.
# For example it can be set to `bridge`, `host`, `none`, `pasta` and more, see the podman-create(1)
# manual for all available options.
#
#netns = ""

# Do not modify the `/etc/hosts` file in the container. Podman assumes control
# over the container's `/etc/hosts` file by default; refer to the `--add-host`
# CLI option for details. To disable this, either set this config to `true`, or
# use the functionally identical `--no-hosts` CLI option.
#
#no_hosts = false

# Tune the host's OOM preferences for containers
# (accepts values from -1000 to 1000).
#oom_score_adj = 0

# Default way to to create a PID namespace for the container
# Options are:
# `private` Create private PID Namespace for the container.
# `host`    Share host PID Namespace with the container.
#
#pidns = "private"

# Maximum number of processes allowed in a container.
#
#pids_limit = 2048

# Copy the content from the underlying image into the newly created volume
# when the container is created instead of when it is started. If false,
# the container engine will not copy the content until the container is started.
# Setting it to true may have negative performance implications.
#
#prepare_volume_on_create = false

# Give extended privileges to all containers. A privileged container turns off
# the security features that isolate the container from the host. Dropped
# Capabilities, limited devices, read-only mount points, Apparmor/SELinux
# separation, and Seccomp filters are all disabled. Due to the disabled
# security features the privileged field should almost never be set as
# containers can easily break out of confinment.
#
# Containers running in a user namespace (e.g., rootless containers) cannot
# have more privileges than the user that launched them.
#
#privileged = false

# Run all containers with root file system mounted read-only
#
# read_only = false

# Path to the seccomp.json profile which is used as the default seccomp profile
# for the runtime.
#
#seccomp_profile = "/usr/share/containers/seccomp.json"

# Size of /dev/shm. Specified as <number><unit>.
# Unit is optional, values:
# b (bytes), k (kilobytes), m (megabytes), or g (gigabytes).
# If the unit is omitted, the system uses bytes.
#
#shm_size = "65536k"

# Set timezone in container. Takes IANA timezones as well as "local",
# which sets the timezone in the container to match the host machine.
#
#tz = ""

# Set umask inside the container
#
#umask = "0022"

# Default way to create a USER namespace for the container.
# Options are:
#   `private` Create private USER Namespace for the container, without adding any UID mappings.
#   `host`    Share host USER Namespace with the container. Root in the container is mapped to the host user UID.
#   `auto`    Automatically create a USER namespace with a unique mapping.
#   `keep-id` Like `private`, but container UIDs are mapped to the host user's subordinate UIDs listed in `/etc/subuid`, and the current user's `UID:GID` are mapped to the same values in the container.
#   `no-map`  Like `keep-id`, but the current user's `UID:GID` does not map to any `UID:GID` inside the container.
#userns = "host"

# Default way to to create a UTS namespace for the container
# Options are:
# `private`        Create private UTS Namespace for the container.
# `host`    Share host UTS Namespace with the container.
#
#utsns = "private"

# List of volumes. Specified as
# "<directory-on-host>:<directory-in-container>:<options>", for example:
# "/db:/var/lib/db:ro".
# If it is empty or commented out, no volumes will be added
#
#volumes = []

#[engine.platform_to_oci_runtime]
#"wasi/wasm" = ["crun-wasm"]
#"wasi/wasm32" = ["crun-wasm"]
#"wasi/wasm64" = ["crun-wasm"]

[secrets]
#driver = "file"

[secrets.opts]
#root = "/example/directory"

[network]

# Network backend determines what network driver will be used to set up and tear down container networks.
# Valid values are "cni" and "netavark".
# The default value is empty which means that it will automatically choose CNI or netavark. If there are
# already containers/images or CNI networks preset it will choose CNI.
#
# Before changing this value all containers must be stopped otherwise it is likely that
# iptables rules and network interfaces might leak on the host. A reboot will fix this.
#
network_backend = "netavark"

# Path to directory where CNI plugin binaries are located.
#
#cni_plugin_dirs = [
#  "/usr/local/libexec/cni",
#  "/usr/libexec/cni",
#  "/usr/local/lib/cni",
#  "/usr/lib/cni",
#  "/opt/cni/bin",
#]

# List of directories that will be searched for netavark plugins.
#
#netavark_plugin_dirs = [
#  "/usr/local/libexec/netavark",
#  "/usr/libexec/netavark",
#  "/usr/local/lib/netavark",
#  "/usr/lib/netavark",
#]

# The firewall driver to be used by netavark.
# The default is empty which means netavark will pick one accordingly. Current supported
# drivers are "iptables", "nftables", "none" (no firewall rules will be created) and "firewalld" (firewalld is
# experimental at the moment and not recommend outside of testing).
#
firewall_driver = "nftables"


# The name of the default network as seen in `podman network ls`. This option only effects the network assignment when
# the bridge network mode is selected, i.e. `--network bridge`. It is the default for rootful containers but not as
# rootless. To change the default network mode use the **netns** option under the `[containers]` table.
#
# Note: This should not be changed while you have any containers using this network.
#
default_network = "podman"

# The default subnet for the default network given in default_network.
#
# Note: This should not be changed if any containers are currently running on the default network.
#
#default_subnet = "10.88.0.0/16"

# DefaultSubnetPools is a list of subnets and size which are used to
# allocate subnets automatically for podman network create.
# It will iterate through the list and will pick the first free subnet
# with the given size. This is only used for ipv4 subnets, ipv6 subnets
# are always assigned randomly.
#
#default_subnet_pools = [
#  {"base" = "10.89.0.0/16", "size" = 24},
#  {"base" = "10.90.0.0/15", "size" = 24},
#  {"base" = "10.92.0.0/14", "size" = 24},
#  {"base" = "10.96.0.0/11", "size" = 24},
#  {"base" = "10.128.0.0/9", "size" = 24},
#]



# Configure which rootless network program to use by default. Valid options are
# `slirp4netns` and `pasta` (default).
#
default_rootless_network_cmd = "slirp4netns"

# Path to the directory where network configuration files are located.
# For the CNI backend the default is "/etc/cni/net.d" as root
# and "$HOME/.config/cni/net.d" as rootless.
# For the netavark backend "/etc/containers/networks" is used as root
# and "$graphroot/networks" as rootless.
#
#network_config_dir = "/etc/cni/net.d/"

# Port to use for dns forwarding daemon with netavark in rootful bridge
# mode and dns enabled.
# Using an alternate port might be useful if other dns services should
# run on the machine.
#
#dns_bind_port = 53

#	A list of default pasta options that should be used running pasta.
# It accepts the pasta cli options, see pasta(1) for the full list of options.
#
#pasta_options = []

[engine]
# Index to the active service
#
#active_service = "production"

#List of compression algorithms. If set makes sure that requested compression variant
#for each platform is added to the manifest list keeping original instance intact in
#the same manifest list on every `manifest push`. Supported values are (`gzip`, `zstd` and `zstd:chunked`).
#`zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning
#in that case.
#
#add_compression = ["gzip", "zstd", "zstd:chunked"]

# Enforces using docker.io for completing short names in Podman's compatibility
# REST API. Note that this will ignore unqualified-search-registries and
# short-name aliases defined in containers-registries.conf(5).
#compat_api_enforce_docker_hub = true

# Specify one or more external providers for the compose command.  The first
# found provider is used for execution.  Can be an absolute and relative path
# or a (file) name.
#compose_providers=[]

# Emit logs on each invocation of the compose command indicating that an
# external compose provider is being executed.
#compose_warning_logs = true

# The compression format to use when pushing an image.
# Valid options are: `gzip`, `zstd` and `zstd:chunked`.
# This field is ignored when pushing images to the docker-daemon and
# docker-archive formats. It is also ignored when the manifest format is set
# to v2s2.
# `zstd:chunked` is incompatible with encrypting images, and will be treated as `zstd` with a warning
# in that case.
#
#compression_format = "gzip"

# The compression level to use when pushing an image.
# Valid options depend on the compression format used.
# For gzip, valid options are 1-9, with a default of 5.
# For zstd, valid options are 1-20, with a default of 3.
#
#compression_level = 5

# Cgroup management implementation used for the runtime.
# Valid options "systemd" or "cgroupfs"
#
cgroup_manager = "systemd"

# Environment variables to pass into conmon
#
#conmon_env_vars = [
#  "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
#]

# Paths to look for the conmon container manager binary
#
#conmon_path = [
#  "/usr/libexec/podman/conmon",
#  "/usr/local/libexec/podman/conmon",
#  "/usr/local/lib/podman/conmon",
#  "/usr/bin/conmon",
#  "/usr/sbin/conmon",
#  "/usr/local/bin/conmon",
#  "/usr/local/sbin/conmon"
#]

# Enforces using docker.io for completing short names in Podman's compatibility
# REST API. Note that this will ignore unqualified-search-registries and
# short-name aliases defined in containers-registries.conf(5).
#compat_api_enforce_docker_hub = true

# The database backend of Podman.  Supported values are "" (default), "boltdb"
# and "sqlite". An empty value means it will check whenever a boltdb already
# exists and use it when it does, otherwise it will use sqlite as default
# (e.g. new installs). This allows for backwards compatibility with older versions.
# Please run `podman-system-reset` prior to changing the database
# backend of an existing deployment, to make sure Podman can operate correctly.
#
#database_backend = ""

# Specify the keys sequence used to detach a container.
# Format is a single character [a-Z] or a comma separated sequence of
# `ctrl-<value>`, where `<value>` is one of:
# `a-z`, `@`, `^`, `[`, `\`, `]`, `^` or `_`
# Specifying "" disables this feature.
#detach_keys = "ctrl-p,ctrl-q"

# Determines whether engine will reserve ports on the host when they are
# forwarded to containers. When enabled, when ports are forwarded to containers,
# ports are held open by as long as the container is running, ensuring that
# they cannot be reused by other programs on the host. However, this can cause
# significant memory usage if a container has many ports forwarded to it.
# Disabling this can save memory.
#
#enable_port_reservation = true

# Environment variables to be used when running the container engine (e.g.,
# Podman, Buildah). For example "MYVAR=value". These environment variables
# will not be used within the container. Set the env section under the
# [containers] table, if you want to set environment variables for the
# container.
# Note when using this to set http proxy variables then they might get
# leaked into the container depending on if `http_proxy` (under the
# [containers] table) is set to to true (default) or false.
#
#env = []

# Define where event logs will be stored, when events_logger is "file".
#events_logfile_path=""

# Sets the maximum size for events_logfile_path.
# The size can be b (bytes), k (kilobytes), m (megabytes), or g (gigabytes).
# The format for the size is `<number><unit>`, e.g., `1b` or `3g`.
# If no unit is included then the size will be read in bytes.
# When the limit is exceeded, the logfile will be rotated and the old one will be deleted.
# If the maximum size is set to 0, then no limit will be applied,
# and the logfile will not be rotated.
#events_logfile_max_size = "1m"

# Selects which logging mechanism to use for container engine events.
# Valid values are `journald`, `file` and `none`.
#
events_logger = "journald"

# Creates a more verbose container-create event which includes a JSON payload
# with detailed information about the container.
#events_container_create_inspect_data = false

# Whenever Podman should log healthcheck events.
# With many running healthcheck on short interval Podman will spam the event
# log a lot as it generates a event for each single healthcheck run. Because
# this event is optional and only useful to external consumers that may want
# to know when a healthcheck is run or failed allow users to turn it off by
# setting it to false. The default is true.
#
#healthcheck_events = true

# A is a list of directories which are used to search for helper binaries.
#
#helper_binaries_dir = [
#  "/usr/local/libexec/podman",
#  "/usr/local/lib/podman",
#  "/usr/libexec/podman",
#  "/usr/lib/podman",
#]

# Path to OCI hooks directories for automatically executed hooks.
#
#hooks_dir = [
#  "/usr/share/containers/oci/hooks.d",
#]

# Directories to scan for CDI Spec files.
#
#cdi_spec_dirs = [
#  "/etc/cdi",
#  "/var/run/cdi",
#]

# Manifest Type (oci, v2s2, or v2s1) to use when pulling, pushing, building
# container images. By default image pulled and pushed match the format of the
# source image. Building/committing defaults to OCI.
#
#image_default_format = ""

# Default transport method for pulling and pushing for images
#
#image_default_transport = "docker://"

# Maximum number of image layers to be copied (pulled/pushed) simultaneously.
# Not setting this field, or setting it to zero, will fall back to containers/image defaults.
#
#image_parallel_copies = 0

# Tells container engines how to handle the built-in image volumes.
#   * anonymous: An anonymous named volume will be created and mounted
#     into the container.
#   * tmpfs: The volume is mounted onto the container as a tmpfs,
#     which allows users to create content that disappears when
#     the container is stopped.
#   * ignore: All volumes are just ignored and no action is taken.
#
#image_volume_mode = ""

# Default command to run the infra container
#
#infra_command = "/pause"

# Infra (pause) container image name for pod infra containers.  When running a
# pod, we start a `pause` process in a container to hold open the namespaces
# associated with the  pod.  This container does nothing other than sleep,
# reserving the pod's resources for the lifetime of the pod. By default container
# engines run a built-in container using the pause executable. If you want override
# specify an image to pull.
#
#infra_image = ""

# Default Kubernetes kind/specification of the kubernetes yaml generated with the `podman kube generate` command.
# The possible options are `pod` and `deployment`.
#kube_generate_type = "pod"

# Specify the locking mechanism to use; valid values are "shm" and "file".
# Change the default only if you are sure of what you are doing, in general
# "file" is useful only on platforms where cgo is not available for using the
# faster "shm" lock type. You may need to run "podman system renumber" after
# you change the lock type.
#
#lock_type = "shm"

# MultiImageArchive - if true, the container engine allows for storing archives
# (e.g., of the docker-archive transport) with multiple images.  By default,
# Podman creates single-image archives.
#
#multi_image_archive = false

# Default engine namespace
# If engine is joined to a namespace, it will see only containers and pods
# that were created in the same namespace, and will create new containers and
# pods in that namespace.
# The default namespace is "", which corresponds to no namespace. When no
# namespace is set, all containers and pods are visible.
#
#namespace = ""

# Path to the slirp4netns binary
#
network_cmd_path = "/usr/bin/slirp4netns"

# Default options to pass to the slirp4netns binary.
# Valid options values are:
#
# - allow_host_loopback=true|false: Allow the slirp4netns to reach the host loopback IP (`10.0.2.2`).
#   Default is false.
# - mtu=MTU: Specify the MTU to use for this network. (Default is `65520`).
# - cidr=CIDR: Specify ip range to use for this network. (Default is `10.0.2.0/24`).
# - enable_ipv6=true|false: Enable IPv6. Default is true. (Required for `outbound_addr6`).
# - outbound_addr=INTERFACE: Specify the outbound interface slirp should bind to (ipv4 traffic only).
# - outbound_addr=IPv4: Specify the outbound ipv4 address slirp should bind to.
# - outbound_addr6=INTERFACE: Specify the outbound interface slirp should bind to (ipv6 traffic only).
# - outbound_addr6=IPv6: Specify the outbound ipv6 address slirp should bind to.
# - port_handler=rootlesskit: Use rootlesskit for port forwarding. Default.
#   Note: Rootlesskit changes the source IP address of incoming packets to a IP address in the container
#   network namespace, usually `10.0.2.100`. If your application requires the real source IP address,
#   e.g. web server logs, use the slirp4netns port handler. The rootlesskit port handler is also used for
#   rootless containers when connected to user-defined networks.
# - port_handler=slirp4netns: Use the slirp4netns port forwarding, it is slower than rootlesskit but
#   preserves the correct source IP address. This port handler cannot be used for user-defined networks.
#
network_cmd_options = [ "--mtu=1500" ]

# Whether to use chroot instead of pivot_root in the runtime
#
#no_pivot_root = false

# Number of locks available for containers, pods, and volumes. Each container,
# pod, and volume consumes 1 lock for as long as it exists.
# If this is changed, a lock renumber must be performed (e.g. with the
# 'podman system renumber' command).
#
#num_locks = 2048

# Set the exit policy of the pod when the last container exits.
#pod_exit_policy = "continue"

# Whether to pull new image before running a container
#
pull_policy = "missing"

# Indicates whether the application should be running in remote mode. This flag modifies the
# --remote option on container engines. Setting the flag to true will default
# `podman --remote=true` for access to the remote Podman service.
#
#remote = false

# Number of times to retry pulling/pushing images in case of failure
#
#retry = 3

# Delay between retries in case pulling/pushing image fails.
# If set, container engines will retry at the set interval,
# otherwise they delay 2 seconds and then exponentially back off.
#
#retry_delay = "2s"

# Default OCI runtime
#
#runtime = "crun"

# List of the OCI runtimes that support --format=json. When json is supported
# engine will use it for reporting nicer errors.
#
#runtime_supports_json = ["crun", "runc", "kata", "runsc", "youki", "krun"]

# List of the OCI runtimes that supports running containers with KVM Separation.
#
#runtime_supports_kvm = ["kata", "krun"]

# List of the OCI runtimes that supports running containers without cgroups.
#
#runtime_supports_nocgroups = ["crun", "krun"]

# Default location for storing temporary container image content. Can be overridden with the TMPDIR environment
# variable. If you specify "storage", then the location of the
# container/storage tmp directory will be used.
# image_copy_tmp_dir="/var/tmp"

# Number of seconds to wait without a connection
# before the `podman system service` times out and exits
#
#service_timeout = 5

# Directory for persistent engine files (database, etc)
# By default, this will be configured relative to where the containers/storage
# stores containers
# Uncomment to change location from this default
#
#static_dir = "/var/lib/containers/storage/libpod"

# Number of seconds to wait for container to exit before sending kill signal.
#
#stop_timeout = 10

# Number of seconds to wait before exit command in API process is given to.
# This mimics Docker's exec cleanup behaviour, where the default is 5 minutes (value is in seconds).
#
#exit_command_delay = 300

# map of service destinations
#
# [engine.service_destinations]
#  [engine.service_destinations.production]
#     URI to access the Podman service
#     Examples:
#       rootless "unix:///run/user/$UID/podman/podman.sock" (Default)
#       rootful "unix:///run/podman/podman.sock (Default)
#       remote rootless ssh://engineering.lab.company.com/run/user/1000/podman/podman.sock
#       remote rootful ssh://[email protected]:22/run/podman/podman.sock
#       tcp/tls remote tcp://10.10.1.136:9443
#
#    uri = "ssh://[email protected]/run/user/1001/podman/podman.sock"
#    Path to file containing ssh identity key
#    identity = "~/.ssh/id_rsa"
#    Path to PEM file containing TLS client certificate
#    tls_cert = "/path/to/certs/podman/tls.crt"
#    Path to PEM file containing TLS client certificate private key
#    tls_key = "/path/to/certs/podman/tls.key"
#    Path to PEM file containing TLS certificate authority (CA) bundle
#    tls_ca = "/path/to/certs/podman/ca.crt"

# Directory for temporary files. Must be tmpfs (wiped after reboot)
#
#tmp_dir = "/run/libpod"

# Directory for libpod named volumes.
# By default, this will be configured relative to where containers/storage
# stores containers.
# Uncomment to change location from this default.
#
#volume_path = "/var/lib/containers/storage/volumes"

# Default timeout (in seconds) for volume plugin operations.
# Plugins are external programs accessed via a REST API; this sets a timeout
# for requests to that API.
# A value of 0 is treated as no timeout.
#volume_plugin_timeout = 5

# Paths to look for a valid OCI runtime (crun, runc, kata, runsc, krun, etc)
[engine.runtimes]
#crun = [
#  "/usr/bin/crun",
#  "/usr/sbin/crun",
#  "/usr/local/bin/crun",
#  "/usr/local/sbin/crun",
#  "/sbin/crun",
#  "/bin/crun",
#  "/run/current-system/sw/bin/crun",
#]

#crun-vm = [
#  "/usr/bin/crun-vm",
#  "/usr/local/bin/crun-vm",
#  "/usr/local/sbin/crun-vm",
#  "/sbin/crun-vm",
#  "/bin/crun-vm",
#  "/run/current-system/sw/bin/crun-vm",
#]

#kata = [
#  "/usr/bin/kata-runtime",
#  "/usr/sbin/kata-runtime",
#  "/usr/local/bin/kata-runtime",
#  "/usr/local/sbin/kata-runtime",
#  "/sbin/kata-runtime",
#  "/bin/kata-runtime",
#  "/usr/bin/kata-qemu",
#  "/usr/bin/kata-fc",
#]

#runc = [
#  "/usr/bin/runc",
#  "/usr/sbin/runc",
#  "/usr/local/bin/runc",
#  "/usr/local/sbin/runc",
#  "/sbin/runc",
#  "/bin/runc",
#  "/usr/lib/cri-o-runc/sbin/runc",
#]

#runsc = [
#  "/usr/bin/runsc",
#  "/usr/sbin/runsc",
#  "/usr/local/bin/runsc",
#  "/usr/local/sbin/runsc",
#  "/bin/runsc",
#  "/sbin/runsc",
#  "/run/current-system/sw/bin/runsc",
#]

#youki = [
#  "/usr/local/bin/youki",
#  "/usr/bin/youki",
#  "/bin/youki",
#  "/run/current-system/sw/bin/youki",
#]

#krun = [
#  "/usr/bin/krun",
#  "/usr/local/bin/krun",
#]

# Default flags for a valid OCI runtime (crun, runc, kata, runsc, krun, etc)
# Note: Do not pass the leading -- to the flag. To pass the runc flag --log-format json, the option given is log-format=json.
[engine.runtimes_flags]
#crun = []

#crun-vm = []

#kata = []

#runc = []

#runsc = []

#youki = []

#krun = []

[engine.volume_plugins]
#testplugin = "/run/podman/plugins/test.sock"

[machine]
# Number of CPU's a machine is created with.
#
#cpus=1

# The size of the disk in GB created when init-ing a podman-machine VM.
#
#disk_size=10

# Default Image used when creating a new VM using `podman machine init`.
# Can be specified as registry with a bootable OCI artifact, download URL, or a local path.
# Registry target must be in the form of `docker://registry/repo/image:version`.
# Container engines translate URIs $OS and $ARCH to the native OS and ARCH.
# URI "https://example.com/$OS/$ARCH/foobar.ami" would become
# "https://example.com/linux/amd64/foobar.ami" on a Linux AMD machine.
# If unspecified, the default Podman machine image will be used.
#
#image = ""

# Memory in MB a machine is created with.
#
#memory=2048

# The username to use and create on the podman machine OS for rootless
# container access.
#
#user = "core"

# Host directories to be mounted as volumes into the VM by default.
# Environment variables like $HOME as well as complete paths are supported for
# the source and destination. An optional third field `:ro` can be used to
# tell the container engines to mount the volume readonly.
#
#volumes = [
#  "$HOME:$HOME",
#]

# Virtualization provider used to run Podman machine.
# If it is empty or commented out, the default provider will be used.
# Linux:
#    qemu    - Open source machine emulator and virtualizer. (Default)
# Windows: there are currently two options:
#    wsl     - Windows Subsystem for Linux (Default)
#    hyperv  - Windows Server Virtualization
# Mac: there are currently two options:
#    applehv - Default Apple Hypervisor (Default)
#    libkrun - Launch virtual machines using the libkrun platform, optimized
#              for sharing GPU with the machine.
#provider = ""

# Rosetta supports running x86_64 Linux binaries on a Podman machine on Apple silicon.
# The default value is `true`. Supported on AppleHV(arm64) machines only.
#
#rosetta=true

# The [machine] table MUST be the last entry in this file.
# (Unless another table is added)
# TOML does not provide a way to end a table other than a further table being
# defined, so every key hereafter will be part of [machine] and not the
# main config.

[farms]
#
# the default farm to use when farming out builds
# default = ""
#
# map of existing farms
#[farms.list]

[podmansh]
# Shell to spawn in container. Default: /bin/sh.
#shell = "/bin/sh"
#
# Name of the container the podmansh user should join.
#container = "podmansh"
#
# Default timeout in seconds for podmansh logins.
# Favored over the deprecated "podmansh_timeout" field.
#timeout = 30

$ tree ~/.config/containers/
/home/markus/.config/containers/
├── auth.json
├── networks
├── podman
│   └── machine