containerd: Podman and alternatives

containerd was accepted into the Incubating status by the CNCF on March 29, 2017. On February 28, 2019, the project reached the Graduated status — the highest status within the CNCF. This means containerd is production-ready, has a healthy developer community, and plays a recognized role in cloud-native infrastructure.

containerd is not an orchestrator like Kubernetes, but the layer that actually runs containers on the host operating system. Kubernetes has worked with containerd by default since version 1.20.

Installing containerd

Install containerd via the package manager:

sudo apt update && sudo apt install containerd -y

On RHEL-based systems, use dnf:

sudo dnf install containerd -y

Configuring containerd

The configuration of containerd is done via a TOML file, typically placed at `/etc/containerd/config.toml`. If this file is not present, containerd uses default settings.

Generate the default configuration:

sudo mkdir -p /etc/containerd
sudo containerd config default | sudo tee /etc/containerd/config.toml

The configuration contains global settings such as `root` (for storing container data) and `state` (for runtime data), and sections for specific components such as `[grpc]` and `[debug]`. The GRPC interface defines the socket address (`/run/containerd/containerd.sock`) used for communication with clients.

Start containerd as a service:

sudo systemctl enable --now containerd

Podman: daemonless container engine

Podman is a container engine developed by Red Hat, available in RHEL 7.6 and later. The first public releases appeared in 2018, with stable version 1.0.0 on January 16, 2019. Podman is compatible with the Open Container Initiative (OCI) standards and uses the same container images as Docker.

Podman is daemonless: it runs containers directly as regular processes under the user who starts them. This eliminates a security risk — an escalated attack on a central daemon such as `dockerd` could otherwise grant access to the entire system.

Red Hat positions Podman as an alternative to Docker when security, UID separation, and systemd integration are important. UID separation allows containers to run under the identity of the starting user, without sudo or root privileges. Podman integrates with systemd, allowing containers to run as system services with automatic startup.

Installing Podman

Install Podman via the package manager:

sudo apt update && sudo apt install podman -y

On RHEL-based systems:

sudo dnf install podman -y

Using Podman

Start a container with Podman:

podman run --name nginx-test -d -p 8080:80 nginx:1.25

View active containers:

podman ps

Podman does not include its own runtime. It uses OCI-compatible runtimes such as `runc`. This makes Podman flexible: it combines a Docker-like interface with the security of a daemonless architecture.

Podman Desktop

On May 23, 2023, Red Hat launched Podman Desktop 1.0, a graphical interface for managing containers without a terminal. Podman Desktop integrates with local and remote Podman instances and shows active containers, images, and pods.

On January 21, 2025, Podman Desktop and Podman Container Tools were officially accepted by the CNCF in the Sandbox status. This status recognizes the projects as promising, but in an early stage of adoption.

Install Podman Desktop via Flatpak:

flatpak install flathub io.podman_desktop.PodmanDesktop -y

containerd versus Podman: the choice

containerd is a runtime: a layer used by other systems to run containers. It is often invisible to the end user and works as part of larger stacks such as Kubernetes.

Podman is an engine with a user interface and CLI, intended for direct use by developers and administrators. It can work together with containerd, but also functions without it.

The choice depends on the use case. containerd is ideal for production clusters where stability and standardization are central. Podman is stronger in development environments and systems where security and user isolation are important.

Alternatives in the container ecosystem

In addition to containerd and Podman, other container runtimes and tools exist:

• CRI-O: lightweight runtime specifically designed to implement the Kubernetes Container Runtime Interface (CRI), often used in Red Hat OpenShift environments
• LXC/LXD: system containers with their own approach to virtualization
• rkt: container runtime from CoreOS, no longer actively developed

Verification

Check whether containerd is running correctly:

sudo systemctl status containerd
sudo ctr version

Check Podman:

podman --version
podman info

Test whether you can run a container:

podman run hello-world

Frequently asked problems

Problem: containerd does not start after installation Check whether the configuration is valid: `sudo containerd config check`. Remove a corrupted configuration file with `sudo rm /etc/containerd/config.toml` and restart.

Problem: Podman cannot pull images Check network access to registries: `podman pull docker.io/library/nginx:1.25`. For DNS issues, add `dns` to `/etc/containers/registries.conf`.

Problem: rootless Podman gives permission errors Install `slirp4netns` and `fuse-overlayfs`: `sudo apt install slirp4netns fuse-overlayfs -y`. Restart the user service with `systemctl --user restart podman.socket`.

The container ecosystem continues to evolve, and the line between runtimes and engines is blurring—the question is not which tool you choose, but which layer you need for your infrastructure.