blog: Podman and Docker Rootless in DDEV, fixes #453 by stasadev · Pull Request #476 · ddev/ddev.com

stasadev · 2025-11-22T17:06:59Z

The Issue

Blog: Podman Support for DDEV #453

How This PR Solves The Issue

Adds a blog.

Manual Testing Instructions

https://pr-476.ddev-com-fork-previews.pages.dev/blog/podman-and-docker-rootless/

Automated Testing Overview

Release/Deployment Notes

github-actions · 2025-11-22T17:08:36Z

🌐 Fork Preview for PR #476

https://pr-476.ddev-com-fork-previews.pages.dev

This preview updates automatically when you push changes to your fork.

rfay · 2025-11-23T15:02:30Z

Just starting on this... Since this will come out before v1.25.0, it should mention the v1.25.0 or HEAD requirement to test, right?

rfay

Here's my first visit. Congrats on this milestone.

As mentioned, this should probably discourage people from using these options unless they know they need them. Early on it should have a link to normal setup and say "You don't need this unless you think you want it :) "

Now I'll experiment with the various options.

src/content/blog/podman-and-docker-rootless.md

rfay · 2025-11-23T15:29:41Z

src/content/blog/podman-and-docker-rootless.md

+   - [Mounting a volume with rootless always assigns ownership to root](https://github.com/moby/moby/issues/45919)
+   - [Add ability to mount volume as user other than root](https://github.com/moby/moby/issues/2259)
+
+   The `root` user inside the container maps to your host user, but many services will not run as root:


It's interesting that this is the same classic problem we've had with Docker Desktop for Linux and for a time with virtiofs.

src/content/blog/podman-and-docker-rootless.md

rfay

Another comment: One reason people have often requested podman is the belief that it was the only open-source alternative to Docker Desktop. We should clear that up in here, pointing out the there are several other fully open source alternatives on every platform.

rfay · 2025-11-25T14:55:49Z

This and docs probably need a compatibility table showing all the options and what works etc.

src/content/blog/podman-and-docker-rootless.md

rfay · 2025-11-26T03:00:24Z

I'm not sure if you already have this in there, but the inability to bind to default ports 80/443 is a pretty significant liability for a web developer.

tyler36 · 2025-11-26T03:23:28Z

Just tried installing rootless podman in a isolated WSL Ubuntu environment:

I got a warning "Problem with your Docker provider: installed Podman version 4.9.3 is not supported, please update to version 5.0 or newer."

But it seem Ubuntu old has older versions available(?)

$ sudo nala search podman
...
podman 4.9.3+ds1-1ubuntu0.2 [Ubuntu/noble universe]
└── tool to manage containers and pods

Install Podman Desktop on windows got a "current" version though:

❯ podman -v
podman version 5.7.0

stasadev · 2025-12-09T19:09:10Z

Summary of Changes from Original Version

Added release status clarity: now explicitly states support is in DDEV HEAD with GA planned for v1.25.0.
Added full platform separation: Linux/WSL2, macOS, and Windows now have dedicated sections.
Added Open Source alternatives to Docker Desktop (Rancher, Lima, Colima, etc).
Improved rootless security explanation by distinguishing container user vs daemon privileges.
Moved subuid/subgid setup into the main Podman Rootless configuration flow (more correct).
Added Docker Rootless loopback/Xdebug fix using RootlessKit environment override.
Added a full runtime comparison table with features and recommendations.

Content that was shortened or removed

Removed the full UID/GID failure error log example and explicit recovery command (podman system migrate).
Removed the explicit privileged ports error message text (rootlessport cannot expose privileged port 80).
Removed the Arch Linux-specific pacman example for fuse-overlayfs.

Overall Impact

Documentation is now broader, more accurate, and more structured.
One-off deep Linux troubleshooting examples were reduced, but no core setup steps were lost.

src/content/blog/podman-and-docker-rootless.md

rfay

I think this should either be targeted at the v1.25.0 release, or alternately promote it earlier and try to get some people to use HEAD.

It's looking good, I added some more suggestions.

Now I'll try some more manual testing.

src/content/blog/podman-and-docker-rootless.md

rfay

I got it working fine on macOS and will use it for a while for daily use.

I didn't succeed with Fedora 43. The /mnt/ddev_config was always mounted as root and couldn't be copied at startup time.

I imagine this was something I did wrong.

src/content/blog/podman-and-docker-rootless.md

stasadev · 2025-12-19T19:25:14Z

I edited the blog:

Removed DOCKER_HOST
Added explanation why to install docker CLI
Removed all the instructions from Podman rootful, but the section remained to show the difference
Simplified instructions
Added checks for already applied settings based on what was done on Fedora

I'm not sure that macOS instructions are correct.

rfay

I tested on podman rootless and docker rootless, Ubuntu 25.10, WSL2 ARM64 and everything went OK. Minor comments. Congrats on all this.

src/content/blog/podman-and-docker-rootless.md

rfay · 2025-12-29T17:25:25Z

src/content/blog/podman-and-docker-rootless.md

+podman system reset
+```
+
+This removes all existing containers, images, and volumes (similar to `docker system prune -a`).


After podman system reset I was no longer able to docker ps (but after reboot I could)

rfay@ub2510:~/workspace/ddev.com$ podman system reset WARNING! This will remove: - all containers - all pods - all images - all networks - all build cache - all machines - all volumes - the graphRoot directory: "/home/rfay/.local/share/containers/storage" - the runRoot directory: "/run/user/1000/containers" Are you sure you want to continue? [y/N] y A "/home/rfay/.config/containers/storage.conf" config file exists. Remove this file if you did not modify the configuration.

I tested it on Arch Linux, and docker ps worked fine without reboot after podman system reset.

but after reboot I could

Maybe this command can help to do it without reboot:

systemctl --user restart podman.socket

stasadev · 2025-12-30T18:39:13Z

I updated the instructions for macOS:

https://pr-476.ddev-com-fork-previews.pages.dev/blog/podman-and-docker-rootless/#macos

stasadev · 2026-01-30T18:02:27Z

TODO: review the blog, and pull it after:

blog: DDEV Release v1.25.0 #526

rfay

Please add a nice table, probably in each OS section, explaining why you might want to use either the traditional approaches or podman, docker, rootless, and what the tradeoffs are. The tradeoffs are quite large when you can't use default ports or have to use --no-bind-mounts. Claude will make these for you fast and easily. The table should usually push people toward the traditional approaches so they don't get confused.

One of the columns: "Why would you do this?". For podman on macOS, it would be just avoidance of Docker. For rootless docker it might be security concerns. Etc.

src/content/blog/podman-and-docker-rootless.md

rfay · 2026-02-01T19:45:40Z

src/content/blog/podman-and-docker-rootless.md

+
+3. Proceed with [DDEV installation](https://docs.ddev.com/en/stable/users/install/ddev-installation/).
+
+4. Handle privileged ports (<1024):


I think this should probably be step 1, to warn people of what's going to happen.

I do wonder why our automatic switching to ephemeral ports doesn't work in this situation.

Okay.

I do wonder why our automatic switching to ephemeral ports doesn't work in this situation.

Since the ephemeral ports don't check the actual bind, the 80/443 ports are available for use.

src/content/blog/podman-and-docker-rootless.md

rfay · 2026-02-02T13:07:33Z

On macOS I can get the URL needed to create a podman docker context in podman machine inspect

          "ConnectionInfo": {
               "PodmanSocket": {
                    "Path": "/var/folders/z5/lhpyjf2n7xj2djl0bw_7kb3m0000gn/T/podman/podman-machine-default-api.sock"
               },
               "PodmanPipe": null
          },

rfay · 2026-02-02T13:17:36Z

src/content/blog/podman-and-docker-rootless.md

+
+This is the recommended configuration for most users.
+
+1. Prepare the system:


Please add a bit more to the system saying what's being prepared. "Prepare the system by configuring subuid and subgid ranges and enabling userns" or something along those lines, probably with links in the sentence. I had never heard of this before, imagine it will be opaque to most folks.

@rfay

Apply suggestions from @rfay, thanks [skip ci] Co-authored-by: Randy Fay <randy@randyfay.com> Refine the article use unprivileged ports on macOS Apply suggestions from @rfay, thanks! Co-authored-by: Randy Fay <randy@randyfay.com> simplify and refactor the blog fix header Mention SELinux Add mkdir Co-authored-by: Randy Fay <randy@randyfay.com> Update macOS instructions Change publication month to 2026-01 refactoring fix command order rootful doesn't work on macOS explain why privileged ports can't work on macOS add memory flag create rootless context, because it's rootless anyway fix TOC links Apply suggestions from @rfay, thanks! Co-authored-by: Randy Fay <randy@randyfay.com>

src/content/blog/podman-and-docker-rootless.md

Co-authored-by: Randy Fay <randy@randyfay.com>

rfay · 2026-02-03T00:10:22Z

src/content/blog/podman-and-docker-rootless.md

+
+Rootless Podman is recommended for most users. However, if you need rootful Podman, the setup differs from rootless in two key ways:
+
+1. User group permissions: configure [group permissions](https://github.com/podman-desktop/podman-desktop/issues/2861#issuecomment-1596192247) to allow non-root users to access the rootful socket


I think you're probaby trying to be really sparse here, but this is a pretty obscure link into an obscure comment. If we think only people who know how to follow obscure links will try it, it's OK.

This is the most important link for Podman rootful. I spent hours trying to set it up, and it was the missing piece for getting permissions to work properly.

rfay · 2026-02-03T00:15:42Z

src/content/blog/podman-and-docker-rootless.md

+
+Rootless Podman is recommended for most users. However, if you need rootful Podman, the setup differs from rootless in two key ways:
+
+1. User group permissions: configure [group permissions](https://github.com/podman-desktop/podman-desktop/issues/2861#issuecomment-1596192247) to allow non-root users to access the rootful socket


I think creation of the podman group (and adding the required user to it) is missing here.

rfay · 2026-02-03T00:18:51Z

src/content/blog/podman-and-docker-rootless.md

+
+   ```bash
+   # Rootless socket (no sudo)
+   systemctl --user enable --now podman.socket


I think creation of the docker context is missing here, and maybe configuration of the docker interface?

rfay · 2026-02-03T00:21:29Z

src/content/blog/podman-and-docker-rootless.md

+   systemctl --user enable --now podman.socket
+
+   # Socket path for rootless
+   ls $XDG_RUNTIME_DIR/podman/podman.sock


I think the "compoare to rootless" will just confuse people and they'll try to follow these instructions.

I don't think XDG_RUNTIME_DIR is there on Ubuntu btw

I don't think XDG_RUNTIME_DIR is there on Ubuntu btw

I see it in my system now. But didn't before. I wonder if some setup showed it.

rfay@rfay-mba-m4:~/workspace/dotfiles$ docker run -it --rm ubuntu:25.10 bash Unable to find image 'ubuntu:25.10' locally 25.10: Pulling from library/ubuntu 541fbd16e24d: Pull complete Digest: sha256:4a9232cc47bf99defcc8860ef6222c99773330367fcecbf21ba2edb0b810a31e Status: Downloaded newer image for ubuntu:25.10 root@f1b4bab69d55:/# env | grep XDG root@f1b4bab69d55:/#

ChatGPT tells me it's set by systemd-logind, so set if you have logged in, not in a container. Should be completely legit. Either I fat-fingered it before or... I can't reproduce not having it.

rfay · 2026-02-03T00:28:30Z

src/content/blog/podman-and-docker-rootless.md

+
+   ```bash
+   # Enable rootful socket (requires sudo)
+   sudo systemctl enable --now podman.socket


With this approach we also need

export DOCKER_HOST=unix:///var/run/podman/podman.sock

or instructions to create a context

I had all of this explained, then I was asked to remove it (because people can confuse rootless with rootful), and now I am being asked to add it back.

It's SO HARD to communicate just the right amount.

This is an awesome article and will help those people that need it.

rfay · 2026-02-03T01:44:57Z

src/content/blog/podman-and-docker-rootless.md

+
+   # Switch to the context
+   docker context use rootless
+


I didn't seem to need any of this. The socket was already set up, etc.

Maybe, but running it doesn't break anything, because I check for the context before creating it.

I didn't have any context created on Arch-based Linux (because I didn't run the script; it's not intended for Arch).

stasadev · 2026-02-03T10:22:41Z

I updated the Podman rootful instructions with inline commands, so they are not copy-pasteable.

rfay

It's a great job on an impossible task! If we find edits/maintenance useful in the future we'll do it!

Of course if this gains traction it will find its way into the docs.

Thanks for working on the whole prereqs, implementation, and documentation for what, a whole year?

Congrats!

github-actions · 2026-02-03T14:47:06Z

PR closed. The Cloudflare Pages preview is no longer updated.

This was referenced Nov 22, 2025

feat: add Podman rootless/rootful and Docker rootless support, fixes #2276, fixes #2899 ddev/ddev#7702

Merged

Support podman as a docker alternative ddev/ddev#2276

Closed

Feature request: Support rootless docker ddev/ddev#2899

Closed

stasadev force-pushed the 20251122_stasadev_podman branch 2 times, most recently from 4eb31c6 to 5dc0225 Compare November 22, 2025 17:26

rfay reviewed Nov 23, 2025

View reviewed changes

rfay reviewed Nov 25, 2025

View reviewed changes

src/content/blog/podman-and-docker-rootless.md Show resolved Hide resolved

rfay reviewed Nov 25, 2025

View reviewed changes

src/content/blog/podman-and-docker-rootless.md Outdated Show resolved Hide resolved

stasadev force-pushed the 20251122_stasadev_podman branch 2 times, most recently from 4dd642a to ae5ec1b Compare December 9, 2025 19:05

stasadev requested a review from rfay December 9, 2025 19:09

stasadev marked this pull request as ready for review December 9, 2025 19:09

stasadev commented Dec 9, 2025

View reviewed changes

src/content/blog/podman-and-docker-rootless.md Outdated Show resolved Hide resolved

rfay force-pushed the 20251122_stasadev_podman branch from bba5f65 to ac6fe7e Compare December 10, 2025 17:33

rfay requested changes Dec 10, 2025

View reviewed changes

rfay requested changes Dec 11, 2025

View reviewed changes

src/content/blog/podman-and-docker-rootless.md Show resolved Hide resolved

src/content/blog/podman-and-docker-rootless.md Outdated Show resolved Hide resolved

stasadev marked this pull request as draft December 11, 2025 19:02

stasadev mentioned this pull request Dec 12, 2025

fix(docker): support SELinux shared label, fixes #7196 ddev/ddev#7939

Merged

stasadev force-pushed the 20251122_stasadev_podman branch from 920e6f0 to ef39216 Compare December 19, 2025 19:15

stasadev requested a review from rfay December 19, 2025 19:26

rfay approved these changes Dec 29, 2025

View reviewed changes

stasadev force-pushed the 20251122_stasadev_podman branch from 2c48e2e to aa3fbf5 Compare December 30, 2025 19:41

stasadev mentioned this pull request Jan 6, 2026

fix: replace rehype-widont with text-wrap: pretty to fix broken anchors #507

Merged

stasadev force-pushed the 20251122_stasadev_podman branch from 01ed945 to 742ee23 Compare January 6, 2026 23:48

rfay requested changes Feb 1, 2026

View reviewed changes

src/content/blog/podman-and-docker-rootless.md Show resolved Hide resolved

rfay reviewed Feb 1, 2026

View reviewed changes

src/content/blog/podman-and-docker-rootless.md Outdated Show resolved Hide resolved

rfay reviewed Feb 2, 2026

View reviewed changes

stasadev and others added 2 commits February 2, 2026 17:02

Update according to @rfay's recommendations

a3dbc59

stasadev force-pushed the 20251122_stasadev_podman branch from b846e0e to a3dbc59 Compare February 2, 2026 15:43

stasadev requested a review from rfay February 2, 2026 15:45

rfay reviewed Feb 2, 2026

View reviewed changes

src/content/blog/podman-and-docker-rootless.md Outdated Show resolved Hide resolved

stasadev and others added 3 commits February 2, 2026 19:43

Apply suggestions from @rfay, thanks!

89c7292

Co-authored-by: Randy Fay <randy@randyfay.com>

Include examples for podman install

8979578

include apt-get update and dnf install --refresh

dc4072c

rfay reviewed Feb 3, 2026

View reviewed changes

rootful podman

f4f7fcc

rfay approved these changes Feb 3, 2026

View reviewed changes

context name is podman-rootless

b0364fc

stasadev merged commit 29e0929 into ddev:main Feb 3, 2026
4 checks passed

stasadev deleted the 20251122_stasadev_podman branch February 3, 2026 14:47


		3. Proceed with [DDEV installation](https://docs.ddev.com/en/stable/users/install/ddev-installation/).

		4. Handle privileged ports (<1024):


		This is the recommended configuration for most users.

		1. Prepare the system:


		Rootless Podman is recommended for most users. However, if you need rootful Podman, the setup differs from rootless in two key ways:

		1. User group permissions: configure [group permissions](https://github.com/podman-desktop/podman-desktop/issues/2861#issuecomment-1596192247) to allow non-root users to access the rootful socket

Uh oh!

Conversation

stasadev commented Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

The Issue

How This PR Solves The Issue

Manual Testing Instructions

Automated Testing Overview

Related Issue Link(s)

Release/Deployment Notes

Uh oh!

github-actions bot commented Nov 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rfay commented Nov 23, 2025

Uh oh!

rfay left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

rfay left a comment

Choose a reason for hiding this comment

Uh oh!

rfay commented Nov 25, 2025

Uh oh!

Uh oh!

Uh oh!

rfay commented Nov 26, 2025

Uh oh!

tyler36 commented Nov 26, 2025

Uh oh!

stasadev commented Dec 9, 2025

Summary of Changes from Original Version

Content that was shortened or removed

Overall Impact

Uh oh!

Uh oh!

rfay left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

rfay left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

stasadev commented Dec 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rfay left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

stasadev commented Dec 30, 2025

Uh oh!

stasadev commented Jan 30, 2026

Uh oh!

stasadev commented Nov 22, 2025 •

edited

Loading

github-actions bot commented Nov 22, 2025 •

edited

Loading

stasadev commented Dec 19, 2025 •

edited

Loading

rfay left a comment •

edited

Loading

rfay Feb 1, 2026 •

edited

Loading

stasadev Feb 3, 2026 •

edited

Loading