On setting up my Arch Linux lab, I’ve reached the point of needing to deploy some container tools.
Since I’ve been using podman for some time on my Mac dev machine, I wanted to continue using it here as well.
While reading about it, I came across the rootless setup described at the Arch Wiki.
This feature ensures that all containers created by a user are isolated from others, as nothing is tied to a root process or shared namespaces.
The first step I took was to install the prerequisites:
sudo pacman -S passt podman fuse-overlayfs podman-compose
passt- userspace networking, adding socket control and isolation to the namespace.fuse-overlayfs- overlay filesystem for rootless mode.podman-compose- tooling similar to Docker Compose.
For podman to use passt (or pasta) as the rootless network, you can modify the containers.conf file in one of three locations (podman reads them in order and later files override earlier settings):
- /usr/share/containers/containers.conf
- /etc/containers/containers.conf
- ~/.config/containers/containers.conf (or XDG_CONFIG_HOME environment variable)
The network configuration that should be changed is default_rootless_network_cmd with the value pasta:
# Options: `slirp4netns` and `pasta` (default).
default_rootless_network_cmd = "pasta"
Another part of the setup is ensuring the user that will create namespaces/containers has UID/GID ranges configured for use within those namespaces.
(Each container gets its own namespace.)
bat --terminal-width 50 /etc/subuid /etc/subgid
─────┬────────────────────────────────────────────
│ File: /etc/subuid
─────┼────────────────────────────────────────────
1 │ fsouza:100000:65536
─────┴────────────────────────────────────────────
─────┬────────────────────────────────────────────
│ File: /etc/subgid
─────┼────────────────────────────────────────────
1 │ fsouza:100000:65536
─────┴────────────────────────────────────────────
We also need to enable lingering, which allows your user’s systemd session (and therefore Podman) to persist even when not logged in:
sudo loginctl enable-linger $USER
Arch typically allows unprivileged namespaces by default, but you can verify with:
sysctl kernel.unprivileged_userns_clone
# should return: kernel.unprivileged_userns_clone = 1
If it returns 0, enable it:
sudo sysctl -w kernel.unprivileged_userns_clone=1
# To make it permanent:
echo "kernel.unprivileged_userns_clone=1" | sudo tee /etc/sysctl.d/99-userns.conf
The podman service for your user does not need to be enabled and running to run containers — this is a key difference from Docker — so keep the service disabled:
systemctl --user status podman.service
○ podman.service - Podman API Service
Loaded: loaded (/usr/lib/systemd/user/podman.service; disabled; preset: enabled)
Active: inactive (dead)
TriggeredBy: ● podman.socket
Docs: man:podman-system-service(1)
You can verify the rootless configuration with podman info:
podman info | grep rootless
rootlessNetworkCmd: pasta
rootless: true
Testing container creation works fine:
[fsouza@fsouza1 ~]$ podman run ubuntu:latest echo "Hello World!"
Hello World!
[fsouza@fsouza1 ~]$ podman ps -a
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
e9c499cac125 docker.io/library/ubuntu:latest echo Hello World! 7 seconds ago Exited (0) 7 seconds ago modest_snyder
If you use devpod (dev pod installation guide), you’ll need to enable the podman.socket service:
systemctl --user enable --now podman.socket
export DOCKER_HOST=unix://$XDG_RUNTIME_DIR/podman/podman.sock
Ps: install as well podman-docker, as devpod trys to run docker commmands: sudo pacman -S podman-docker. podman-docker arch package.
You can then add a docker provider to devpod and have your dev containers running:
devpod provider add docker
devpod provider use docker
I have a sample devpod recipe with ubuntu as follow, just put the content in a devcontainer.json file:
{
"name": "DevPod",
"image": "ubuntu:latest",
"extensions": [
"ms-azuretools.vscode-docker"
]
}
Within the dir your have your devcontainer.json just bring it up:
devpod up .
You cna now ssh / go into the devpod container:
devpod ssh
10:09:05 info Emulate Docker CLI using podman. Create /etc/containers/nodocker to quiet msg.
vscode ➜ /workspaces/test-devpod $ hostname -a
ecstatic_banzai
You can see that podman is running your container as well:
podman ps
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
84f5c1844d78 mcr.microsoft.com/devcontainers/base:ubuntu -c echo Container... 6 minutes ago Up 6 minutes ecstatic_banzai
You can configure containers to start at boot using systemd; podman can generate the service files for you.
podman generate systemd --new --name modest_snyder
# DEPRECATED command:
# It is recommended to use Quadlets for running containers and pods under systemd.
# Please refer to podman-systemd.unit(5) for details.
# container-modest_snyder.service
# autogenerated by Podman 5.8.1
# Mon Mar 23 16:40:30 CET 2026
[Unit]
Description=Podman container-modest_snyder.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers
[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStart=/usr/bin/podman run \
--cidfile=%t/%n.ctr-id \
--cgroups=no-conmon \
--rm \
--sdnotify=conmon \
-d ubuntu:latest echo "Hello World!"
ExecStop=/usr/bin/podman stop \
--ignore -t 10 \
--cidfile=%t/%n.ctr-id
ExecStopPost=/usr/bin/podman rm \
-f \
--ignore -t 10 \
--cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all
[Install]
WantedBy=default.target
The systemd service file can be saved as ~/.config/systemd/user/hello.service, then enabled with:
podman generate systemd --new --name modest_snyder > ~/.config/systemd/user/hello.service
Let’s enable the service and check the status:
systemctl --user enable --now hello.service
systemctl --user status hello.service
○ hello.service - Podman container-modest_snyder.service
Loaded: loaded (/home/fsouza/.config/systemd/user/hello.service; enabled; preset: enabled)
Active: inactive (dead) since Mon 2026-03-23 16:46:19 CET; 57s ago
Duration: 112ms
Invocation: 5dfb9dac285d4cb59f46be682da177a8
Docs: man:podman-generate-systemd(1)
Process: 28514 ExecStart=/usr/bin/podman run --cidfile=/run/user/1000/hello.service.ctr-id --cgroups=no-conmon --rm --sdnotify=conmon -d ubuntu:latest echo Hello World! (code=exited, status=0/SUCCESS)
Process: 28541 ExecStop=/usr/bin/podman stop --ignore -t 10 --cidfile=/run/user/1000/hello.service.ctr-id (code=exited, status=0/SUCCESS)
Process: 28554 ExecStopPost=/usr/bin/podman rm -f --ignore -t 10 --cidfile=/run/user/1000/hello.service.ctr-id (code=exited, status=0/SUCCESS)
Main PID: 28514 (code=exited, status=0/SUCCESS)
Mem peak: 46.6M
CPU: 272ms
Mar 23 16:46:19 fsouza1 systemd[1095]: Starting Podman container-modest_snyder.service...
Mar 23 16:46:19 fsouza1 podman[28486]: 2026-03-23 16:46:19.136492416 +0100 CET m=+0.039238508 container create 51b224a3966d33fda9837d8b456d3f1db348cfdb668e89b1433ac6bb76fbbc1c (image=docker.io/library/ubuntu:latest, name=recursing_heisenberg, PODMAN_SYSTEMD_UNIT=hello.service, org.opencontainers.image.ref.name=ubuntu>
Mar 23 16:46:19 fsouza1 podman[28486]: 2026-03-23 16:46:19.211968908 +0100 CET m=+0.114715140 container init 51b224a3966d33fda9837d8b456d3f1db348cfdb668e89b1433ac6bb76fbbc1c (image=docker.io/library/ubuntu:latest, name=recursing_heisenberg, PODMAN_SYSTEMD_UNIT=hello.service, org.opencontainers.image.ref.name=ubuntu, >
Mar 23 16:46:19 fsouza1 podman[28486]: 2026-03-23 16:46:19.119069741 +0100 CET m=+0.021815972 image pull f794f40ddfff5af8ef1b39ee29eab3b5400ea70b9ebefd286812dbbe0054ad6b ubuntu:latest
Mar 23 16:46:19 fsouza1 podman[28486]: 2026-03-23 16:46:19.215996166 +0100 CET m=+0.118742328 container start 51b224a3966d33fda9837d8b456d3f1db348cfdb668e89b1433ac6bb76fbbc1c (image=docker.io/library/ubuntu:latest, name=recursing_heisenberg, PODMAN_SYSTEMD_UNIT=hello.service, org.opencontainers.image.ref.name=ubuntu,>
Mar 23 16:46:19 fsouza1 systemd[1095]: Started Podman container-modest_snyder.service.
Mar 23 16:46:19 fsouza1 recursing_heisenberg[28514]: Hello World!
Mar 23 16:46:19 fsouza1 podman[28522]: 2026-03-23 16:46:19.256424069 +0100 CET m=+0.021677756 container died 51b224a3966d33fda9837d8b456d3f1db348cfdb668e89b1433ac6bb76fbbc1c (image=docker.io/library/ubuntu:latest, name=recursing_heisenberg, PODMAN_SYSTEMD_UNIT=hello.service, org.opencontainers.image.ref.name=ubuntu, >
Mar 23 16:46:19 fsouza1 podman[28522]: 2026-03-23 16:46:19.323942776 +0100 CET m=+0.089196463 container remove 51b224a3966d33fda9837d8b456d3f1db348cfdb668e89b1433ac6bb76fbbc1c (image=docker.io/library/ubuntu:latest, name=recursing_heisenberg, PODMAN_SYSTEMD_UNIT=hello.service, org.opencontainers.image.ref.name=ubuntu>
lines 1-23/23 (END)