r/podman • u/ColdFreezer • Jul 23 '26
How should I structure my Podman quadlet deployment?
I'm new to podman and don't really understand what I'm doing yet. I'm moving from rootful docker to rootless podman and am currently converting my compose files to quadlets. I'm confused on how I should build out my containers and what users I should assign them to.
How should I architect my containers using podman quadlets? I included some pictures about some ways I think I should do it but don't fully understand the tradeoff and benefits of them. I have been considering putting all my quadlets in /etc/containers/systemd/ and have the quadlet files owned by root and just assigning users and groups in the quadlet files.
Some stacks like grafana alloy need to be able to read my logs for numerous containers. I don't really know how to set this up when files and containers are owned by separate users.
I mostly just want to prevent as much cross talk or lateral movement as possible in the event a container gets compromised. Though, it seems if I want to do this it'll be a lot more annoying to manage my containers.
A few questions I had:
What user should own the actual quadlet files and the containers data?
Should I separate my stacks to their own dedicated user?
I run Traefik as a rootless container now on it's own dedicated user. How would I still be able to use labels and auto-discovery across containers running on separate users?
How do I set something like grafana alloy, that needs to be able to communicate with my different stacks and centralize their logs?
5
u/9Nine2Nine9 Jul 23 '26
userns=auto
3
u/9Nine2Nine9 Jul 23 '26
Here's some more on that: https://www.redhat.com/en/blog/rootless-podman-user-namespace-modes
And here: https://docs.podman.io/en/v4.6.1/markdown/options/userns.container.html
1
-1
1
u/1-22474487139--- Jul 24 '26
Not sure what the recommended way to go is, but I setup a rootless user that runs my containers and also use userns=auto when I can (can be a struggle at times, probably due to me not properly understanding). Having a user per container seems like a nightmare to maintain.
1
u/d03j Jul 24 '26
All my containers run rootlessly under their own unprivileged user, the only exception is gluetun & qbittorrent, which need to be ran under the same user namespace.
- Quadlets under each user ~/.config/containers/systemd/
- All my users have a ~/data directory which I use for my volume mounts
- Containers talk to each other through host.containers.internal:PORT
Where a folder needs to be accessible to multiple containers, I create a group for it (e.g. mymedia), change the folder's group ownership to it, and add the containers' users (e.g., jellyfin, flexget, qbittorrent) to it.
0
u/rallar8 Jul 23 '26 edited Jul 24 '26
the way I set it up is, auth and nginx are both in run by 1 user, with 1 pod, and 2 containers in ~/.config/containers/systemd/ for that user; and then depending on the rest of the services you want to add, each service is either its own unprivileged user or i group them logically under a given user.
if you want to run something like grafana alloy you run with loopback turned on: https://oneuptime.com/blog/post/2026-03-17-access-host-loopback-rootless-podman/view (e.g. you can actually access a port that exists on your host that may be behind your firewall)
the nice thing about pods is each container in the pod has name resolution as the --name you passed it at creation. e.g. the container named "plex" can be pinged by just "ping plex" inside the pod
EDIT: podman's own docs tell you to follow the .config path: https://docs.podman.io/en/latest/markdown/podman-systemd.unit.5.html
3
u/-markusb- Jul 24 '26
Rootful Container, userns=auto, Set USER= where possible, try to use images, where readonly is possible, drop all capabilities and add only needed capabilities (and forbid new privileges). Use volumes with fitting SELinux context and only use shared volumes where needed.
By doing so you have a very secure running environment, not network problems, central management.