Podman

Podman has been my choice, not only because it’s safer than docker but it’s also very powerful. Daemonless, integrates very well with systemd with quadlets, rootless if needed, and plays well in pods or kubes.

keep containers running

Containers will run until the owner is logged in. To let them run after the ssh session, lingering must be enabled for the user with loginctl enable-linger.

SElinux directory labels

:ro

is read only

:z

is shared among containers

:Z

is exclusive for the container using it.

Tip

Read a log of what went wrong with your quadlet:

/usr/lib/systemd/system-generators/podman-system-generator --user --dryrun

Tip

Containers log example: journalctl --user -xeu caddy.service

Warning

In rootless mode, always use systemctl --user <command> to enable new containers