Podman instructions using Quadlet

[leleobhz]

Is your feature request related to a problem? Please describe

Hello!

This is not a duplicated of any issue.

Describe the solution you'd like

I suggest documentation instructs to add the file /etc/containers/systemd/portainer.container with the following content:

[Unit]
Description=Portainer on Podman
After=podman.socket

[Container]
Image=docker.io/portainer/portainer-ce:2.26.1
Volume=portainer_data:/data
Volume=/run/podman/podman.sock:/var/run/docker.sock
PublishPort=9443:9443
PublishPort=8000:8000

# https://github.com/containers/podman/issues/22487#issuecomment-2074962547
Unmask=all
SecurityLabelDisable=true
AddCapability=all
SeccompProfile=unconfined

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=multi-user.target default.target

This Quadlet is fully equivalent to podman command already on documentation and its the proper way to enable it on boot.

Describe alternatives you've considered

The initial way to do is the one documented at https://docs.portainer.io/2.26/start/install-ce/server/podman/linux

Additional context

No response

[hackel]

Does this work without PodmanArgs=--privileged?

[leleobhz]

Does this work without PodmanArgs=--privileged?

I run Portainer w/o that flag:

[root@miriam ~]# podman inspect systemd-portainer | grep -i privileg
               "Privileged": false,
[root@miriam ~]#

In fact, only podman must be enabled as service on system (as root):

[root@miriam ~]# systemctl status podman.socket
● podman.socket - Podman API Socket
     Loaded: loaded (/usr/lib/systemd/system/podman.socket; enabled; preset: disabled)
     Active: active (listening) since Thu 2025-06-26 06:25:15 -03; 9h ago
 Invocation: 397d954b9b1a4ddb8a3f4265f0fdd915
   Triggers: ● podman.service
       Docs: man:podman-system-service(1)
     Listen: /run/podman/podman.sock (Stream)
     CGroup: /system.slice/podman.socket

jun 26 06:25:15 miriam systemd[1]: Listening on Podman API Socket.
[root@miriam ~]#

[hackel]

Brilliant, thanks!

[steffenba]

I had issues with the default "podman run" instructions from the docs on RHEL 10 (CIS1, FIPS) deploying the podman agent.

Therefore, I would also add the following instructions for agent machines using podman:

[Unit]
Description=Portainer Agent

[Install]
WantedBy=default.target

[Container]
Image=docker.io/portainer/agent:2.33.6
PublishPort=9001:9001
ContainerName=portainer_agent
Volume=/run/podman/podman.sock:/var/run/docker.sock
Volume=/var/lib/containers/storage/volumes:/var/lib/docker/volumes
Volume=/:/host
PodmanArgs=--privileged

[Service]
Restart=always

Which essentially corresponds to what the Wizard tells you to do.

Quadlets are the way to go with podman. They can be confusing for newcomers though.