Haack's Wiki

Rootless Podman runs as user worker (uid 1001). Lingering is enabled. Graph root is /home/worker/podman-local. Cgroup manager is systemd. Units come from Quadlet files in ~/.config/containers/systemd/. Do not use podman generate systemd.

adduser --system --group --home /home/worker worker
loginctl enable-linger worker

Verify:

loginctl show-user worker -p Linger
id worker

Expect Linger=yes.

apt install -y podman podman-compose

Confirm as worker:

podman version
podman info --format '{{.Host.Security.Rootless}} {{.Host.CgroupManager}} {{.Store.GraphRoot}}'

Expect true systemd /home/worker/podman-local.

User units need the session bus. As worker:

export XDG_RUNTIME_DIR=/run/user/$(id -u)
export DBUS_SESSION_BUS_ADDRESS=unix:path=${XDG_RUNTIME_DIR}/bus

Do not use sudo -u worker. That drops the session bus. Use su - worker or run as worker directly.

Units live in ~/.config/containers/systemd/. Example structure:

mkdir -p ~/.config/containers/systemd

A .container file has [Container], [Service], and [Install]. WantedBy=default.target starts it. Do not systemctl –user enable a Quadlet unit. Do not podman generate systemd.

After creating or editing a .container file:

systemctl --user daemon-reload
systemctl --user reset-failed container-NAME.service
systemctl --user start container-NAME.service

systemctl --user is-active container-*.service
podman ps -a
podman info --format '{{.Host.Security.Rootless}} {{.Store.GraphRoot}}'
ls -la ~/.config/containers/systemd/

Expect rootless true, graph root /home/worker/podman-local, and the Quadlet files present. Also, the directory for podman is on the host and uses virtiofs. This keeps the configs and container data accessible by the host. If you need help on setting up virtiofs mounts and configuring the VM, head to Virt Manager Hell.

• R

— oemb1905 2026/10/10 01:39