Podman — cheat sheet

A one-page lookup for the commands and flags used across this course. Grouped by task; the course pages cover the why behind each one — this page is just the what.

Images

Task	Command
Pull an image	podman pull <registry>/<image>:<tag>
List local images	podman images
List with digests	podman images --digests
Inspect an image	podman inspect <image>:<tag>
Build from a Containerfile	podman build -t name:tag -f Containerfile .
Tag an image	podman tag src:tag dst:tag
Push to a registry	podman push <registry>/<image>:<tag>
Remove an image	podman rmi <image>:<tag>
Save to a tarball	podman save -o file.tar image:tag
Load from a tarball	podman load -i file.tar
Login / logout	podman login <registry> / podman logout <registry>

Containers — lifecycle

Task	Command
Run (create + start)	podman run -d --name N image
Create, start later	podman create --name N image then podman start N
List running	podman ps
List all (incl. stopped)	podman ps -a
Logs	podman logs N / podman logs -f N (follow)
Shell inside	podman exec -it N /bin/sh
Stop / kill	podman stop N (SIGTERM then SIGKILL) / podman kill N (immediate)
Restart	podman restart N
Remove	podman rm N / podman rm -f N (stop then remove)
Copy in/out	podman cp ./local N:/path / podman cp N:/path ./local
Live resource stats	podman stats N

Run flags worth memorising

Flag	What it does
-d	Detach; don't attach stdio
--name <n>	Name the container (needed for later start/stop)
-p host:container	Publish a port
-v name:/path or -v /host:/ctr	Named volume or bind mount
-e KEY=VAL	Set an env var
--rm	Remove the container on exit (one-shots)
--restart=always	Restart on exit (pair with podman-restart.service)
--user UID:GID	Override the image's USER
--cap-drop=ALL / --cap-add=<cap>	Drop everything, add back what's needed
--read-only	Read-only rootfs

Networking

Task	Command
Create a bridge network	podman network create <name>
List / inspect / remove	podman network ls / network inspect <name> / network rm <name>
Attach a container	podman run --network <name> ...
Fix a rootless privileged-port bind	Publish on a host port ≥ 1024 (-p 8080:80) instead of -p 80:80

Storage

Task	Command
Create a named volume	podman volume create <name>
List / inspect / remove	podman volume ls / volume inspect <name> / volume rm <name>
Prune unused volumes	podman volume prune
Private SELinux relabel	-v /host/path:/ctr/path:Z
Shared SELinux relabel	-v /host/path:/ctr/path:z

Pods

Task	Command
Create a pod	podman pod create --name <name> -p host:container
Add a container to a pod	podman run --pod <name> ...
List / inspect	podman pod ps / podman pod inspect <name>
Stop / remove	podman pod stop <name> / podman pod rm -f <name>

Kubernetes YAML

Task	Command
Run a Pod/Deployment YAML	podman play kube <file>.yaml
Tear it down	podman play kube --down <file>.yaml
Export running pods to YAML	podman generate kube <pod> > out.yaml

System

Task	Command
Engine + storage info	podman info
Disk usage	podman system df
Prune unused data	podman system prune
Real-time event stream	podman events

How this connects

The storage page covers the :Z/:z distinction in depth, the networking page covers the rootless privileged-port fixes, and the rootless & security page covers the capability flags above.