Technical Documentation: containers/podman-compose
โน๏ธ Provenance: Multi-Tier Ingestion ยท CodeWiki Reference
Overview (`README.md`)
Podman Compose
[](https://github.com/containers/podman-compose/actions/workflows/test.yml)
An implementation of Compose Spec with Podman backend.
This project focuses on:
- rootless
- daemon-less process model, we directly execute podman, no running daemon.
This project only depends on:
podman- a podman network backend with DNS name resolution available. This allows containers to be able to resolve each other if they are on the same network.
- either: podman dnsname plugin with CNI network backend: It is usually found in the
podman-pluginsorpodman-dnsnamedistro packages, those packages are not pulled by default and you need to install them. - or: netavark/aardvark-dns: Both are usually installed on new installations of podman 4.
- either: podman dnsname plugin with CNI network backend: It is usually found in the
- Python 3.9 or newer
- PyYAML
- python-dotenv
And it's formed as a single Python file script that you can drop into your PATH and run.
References:
Alternatives
As in this article you can setup a podman.socket and use unmodified docker-compose that talks to that socket but in this case you lose the process-model (ex. docker-compose build will send a possibly large context tarball to the daemon)
For production-like single-machine containerized environment consider
For the real thing (multi-node clusters) check any production
OpenShift/Kubernetes distribution like OKD.
Versions
If you have legacy version of podman (before 3.1.0) you might need to stick with legacy podman-compose 0.1.x branch.
The legacy branch 0.1.x uses mappings and workarounds to compensate for rootless limitations.
Modern podman versions (>=3.4) do not have those limitations, and thus you can use latest and stable 1.x branch.
If you are upgrading from podman-compose version 0.1.x then we no longer have global option -t to set mapping type
like hostnet. If you desire that behavior, pass it the standard way like network_mode: host in the YAML.
Installation
Pip
Install the latest stable version from PyPI:
pip3 install podman-composepass --user to install inside a regular user's home without being root.
Or latest development version from GitHub:
pip3 install https://github.com/containers/podman-compose/archive/main.tar.gzPackage repositories
podman-compose is available from the following package repositories:
Debian:
sudo apt install podman-composeFedora (starting from f31) repositories:
sudo dnf install podman-composeHomebrew:
brew install podman-composeGenerate binary using docker/podman locally
This script will download the repo, generate the binary using this Dockerfile, and place the binary in the directory where you called this script.
sh -c "$(curl -sSL https://raw.githubusercontent.com/containers/podman-compose/main/scripts/download_and_build_podman-compose.sh)"Manual
curl -o /usr/local/bin/podman-compose https://raw.githubusercontent.com/containers/podman-compose/main/podman_compose.py
chmod +x /usr/local/bin/podman-composeor inside your home
curl -o ~/.local/bin/podman-compose https://raw.githubusercontent.com/containers/podman-compose/main/podman_compose.py
chmod +x ~/.local/bin/podman-composeTests
podman-compose is tested via unit and integration tests.
Unit tests can be run via the following:
python3 -m unittest discover tests/unitIntegration tests can be run via the following:
python3 -m unittest discover tests/integrationContributing guide
If you are a user or a developer and want to contribute please check the CONTRIBUTING section
Overview (`examples/awx17/README.md`)
AWX Compose
The directory roles is taken from here
also look at https://github.com/ansible/awx/tree/17.1.0/tools/docker-compose
mkdir deploy awx17
ansible localhost \
-e host_port=8080 \
-e awx_secret_key='awx,secret.123' \
-e secret_key='awx,secret.123' \
-e admin_user='admin' \
-e admin_password='admin' \
-e pg_password='awx,123.' \
-e pg_username='awx' \
-e pg_database='awx' \
-e pg_port='5432' \
-e redis_image="docker.io/library/redis:6-alpine" \
-e postgres_data_dir="./data/pg" \
-e compose_start_containers=false \
-e dockerhub_base='docker.io/ansible' \
-e awx_image='docker.io/ansible/awx' \
-e awx_version='17.1.0' \
-e dockerhub_version='17.1.0' \
-e docker_deploy_base_path=$PWD/deploy \
-e docker_compose_dir=$PWD/awx17 \
-e awx_task_hostname=awx \
-e awx_web_hostname=awxweb \
-m include_role -a name=local_docker
cp awx17/docker-compose.yml awx17/docker-compose.yml.orig
sed -i -re "s#- \"$PWD/awx17/(.*):/#- \"./\1:/#" awx17/docker-compose.yml
cd awx17
podman-compose run --rm --service-ports task awx-manage migrate --no-input
podman-compose up -dOverview (`examples/azure-vote/README.md`)
Azure Vote Example
This example has two containers:
- backend:
redisused as storage - frontend: having supervisord, nginx, uwsgi/python
echo "HOST_PORT=8080" > .env
podman-compose upAfter typing the commands above, open your browser on the host port you picked above, like
http://localhost:8080/
Overview (`examples/echo/README.md`)
Echo Service example
podman-compose upTest the service with curl like this:
$ curl -X POST -d "foobar" http://localhost:8080/; echo
CLIENT VALUES:
client_address=10.89.31.2
command=POST
real path=/
query=nil
request_version=1.1
request_uri=http://localhost:8080/
SERVER VALUES:
server_version=nginx: 1.10.0 - lua: 10001
HEADERS RECEIVED:
accept=*/*
content-length=6
content-type=application/x-www-form-urlencoded
host=localhost:8080
user-agent=curl/7.76.1
BODY:
foobarOverview (`examples/hello-app-redis/README.md`)
GCR Hello App Redis
A 6-node redis cluster using Bitnami
with a simple hit counter that persists on that redis cluster
podman-compose upthen open your browser on http://localhost:8080/
Overview (`examples/hello-app/README.md`)
GCR Hello App
A small ~2MB image, type
podman-compose upthen open your browser on http://localhost:8080/
Overview (`examples/hello-python/README.md`)
Simple Python Demo
A Redis counter
podman-compose up -d
curl localhost:8080/
curl localhost:8080/hello.jsonOverview (`examples/nodeproj/README.md`)
How to run example
cp example.local.env local.env
cp example.env .env
cat local.env
cat .env
echo "UID=$UID" >> .env
cat .env
podman-compose build
podman-compose run --rm --no-deps init
podman-compose upOverview (`tests/integration/additional_contexts/README.md`)
Test podman-compose with build.additional_contexts
podman-compose build
podman-compose up
podman-compose downThe expected output is
[dict] | Data for dict
[list] | Data for listOverview (`tests/integration/vol/README.md`)
To test, create the two external volumes
podman volume create my-app-data
podman volume create actual-name-of-volume
podman-compose upChangelog 1.1.0 (`docs/Changelog-1.1.0.md`)
Version v1.1.0 (2024-04-17)
Bug fixes
- Fixed support for values with equals sign in
-eargument ofrunandexeccommands. - Fixed duplicate arguments being emitted in
stopandrestartcommands. - Removed extraneous debug output.
--verboseflag has been added to preserve verbose output. - Links aliases are now added to service aliases.
- Fixed image build process to use defined environment variables.
- Empty list is now allowed to be
COMMANDandENTRYPOINT. - Environment files are now resolved relative to current working directory.
- Exit code of container build is now preserved as return code of
buildcommand.
New features
- Added support for
uidmap,gidmap,http_proxyandruntimeservice configuration keys. - Added support for
enable_ipv6network configuration key. - Added
--paralleloption to support parallel pulling and building of images. - Implemented support for maps in
sysctlscontainer configuration key. - Implemented
statscommand. - Added
--no-normalizeflag toconfigcommand. - Added support for
includeglobal configuration key. - Added support for
buildcommand. - Added support to start containers with multiple networks.
- Added support for
profileargument. - Added support for starting podman in existing network namespace.
- Added IPAM driver support.
- Added support for file secrets being passed to
podman buildvia--secretargument. - Added support for multiple networks with separately specified IP and MAC address.
- Added support for
service.build.ulimitswhen building image.
Changelog 1.2.0 (`docs/Changelog-1.2.0.md`)
Version v1.2.0 (2024-06-26)
Bug fixes
- Fixed handling of
--in-podargument. Previously it was hard to provide false value to it. - podman-compose no longer creates pods when registering systemd unit.
- Fixed warning
RuntimeWarning: coroutine 'create_pods' was never awaited - Fixed error when setting up IPAM network with default driver.
- Fixed support for having list and dictionary
depends_onsections in related compose files. - Fixed logging of failed build message.
- Fixed support for multiple entries in
includesection. - Fixed environment variable precedence order.
Changes
x-podmandictionary in container root has been migrated tox-podman.*fields in container root.
New features
- Added support for
--publishinpodman-compose run. - Added support for Podman external root filesystem management (
--rootfsoption). - Added support for
podman-compose imagescommand. - Added support for
env_filebeing configured via dictionaries. - Added support for enabling GPU access.
- Added support for selinux in verbose mount specification.
- Added support for
additional_contextssection. - Added support for multi-line environment files.
- Added support for passing contents of
podman-compose.ymlvia stdin. - Added support for specifying the value for
--in-podsetting inpodman-compose.ymlfile. - Added support for environment secrets.
Documentation
- Added instructions on how to install podman-compose on Homebrew.
- Added explanation that netavark is an alternative to dnsname plugin
Changelog 1.3.0 (`docs/Changelog-1.3.0.md`)
Version 1.3.0 (2025-01-07)
Bug fixes
- Fixed support for de-facto alternative
Dockerfilenames (e.g.Containerfile) - Fixed a bug that caused attempts to create already existing pods multiple times.
- Fixed compatibility with docker-compose in how symlinks to docker-compose.yml are handled.
- Fixed freeze caused by too long log lines without a newline.
- Fixed support for
network_mode: none. - Improved error detection by rejecting service definitions that contain both
network_modeandnetworkskeys, which is not allowed.
Features
- Added support for build labels.
- Added support for "platform" property in the build command.
- Added support for "ssh" property in the build command.
- Added support for cache_from and cache_to fields in build section.
- Added support for honoring the condition in the depends_on section of the service, if stated.
- Added
x-podman.no_hostssetting to pass--no-hoststo podman run - Added support for compatibility with docker compose for default network behavior when no network
defined in service. This is controlled viadefault_net_behavior_compatfeature flag. - Added a way to get compatibility of default network names with docker compose.
This is selected by settingdefault_net_name_compat: trueonx-podmanglobal dictionary. - Added support for the
device_cgroup_rulesproperty in services. - Added support for removing networks in
podman-compose down. - Added support for network scoped service aliases.
- Added support for network level
mac_addressattribute. - Added the ability to substitute variables with the environment of the service.
Misc
- Declared compatibility with Python 3.13.
Changelog 1.4.0 (`docs/Changelog-1.4.0.md`)
Version 1.4.0 (2025-05-10)
Bug fixes
- Fixed handling of relative includes and extends in compose files
- Fixed error when merging arguments in list and dictionary syntax
- Fixed issue where short-lived containers could execute twice when using
upin detached mode - Fixed
upcommand hanging on Podman versions earlier than 4.6.0 - Fixed issue where
service_healthyconditions weren't enforced duringupcommand - Fixed support for the
--scaleflag - Fixed bug causing dependent containers to start despite
--no-depsflag - Fixed port command behavior for dynamic host ports
- Fixed interpolation of
COMPOSE_PROJECT_NAMEwhen set from top-levelnamein compose file - Fixed project name evaluation order to match compose spec
- Fixed build context when using git URLs
- Fixed
KeyErrorwhendownis called with non-existent service - Skip
downduringupwhen no active containers exist - Fixed non-zero exit code on failure when using
up -d - Fixed SIGINT handling during
upcommand for graceful shutdown - Fixed
NotImplementedErrorwhen interrupted on Windows
Features
- Added
--quietflag toconfigcommand to suppress output - Added support for
pids_limitanddeploy.resources.limits.pids - Added
--abort-on-container-failureoption - Added
--rmiargument todowncommand for image removal - Added support for
x-podman.disable-dnsto disable DNS plugin on defined networks - Added support for
x-podman.dnsto set DNS nameservers for defined networks - Improved file descriptor handling by no longer closing externally created descriptors.
This allows descriptors created e.g. via systemd socket activation to be passed to
containers. - Added support for
cpusetconfiguration - Added support for
resetandoverridetags when merging compose files - Added support for
x-podman.interface_nameto set network interface names - Added support for
x-podman.pod_argsto override default--pod-args
Changelog 1.4.1 (`docs/Changelog-1.4.1.md`)
Version 1.4.1 (2025-06-05)
Bug fixes
- Fixed relative host path resolution for volume bind mount source
Changelog 1.5.0 (`docs/Changelog-1.5.0.md`)
Version 1.5.0 (2025-07-07)
Bug fixes
- Fixed path to a local SSH key to be relative to the directory of compose file during build.
- Fixed CMD healthchecks to run the given command directly and not use
/bin/sh -c. - Fixed regression of dockerfile definition if current directory name ends with ".git".
- Fixed exit code from
pushcommand. - Implemented short syntax for environment variables set in
.envfor compose.ymlenvironment:section. - Fixed regression of log output including "text" in detached mode.
- Implemented
up --no-recreateto work as advertised. - Stack traces emitted due to YAML parse errors are now hidden.
Features
- Added unregister command to remove systemd service registration (
podman-compose systemd -a unregister) - Added new
docker_compose_compatx-podmanmeta setting to enable all Docker Compose compatibility settings - Added new
name_separator_compatx-podmansetting to change name separator to hyphen, same as Docker Compose. - Added support for environment variable interpolation for YAML keys.
- Added
io.podman.compose.servicelabel to created containers. It contains the same value ascom.docker.compose.service. - Added relabel option to secret to make possible to read the secret file by the container process.
- Added support for setting x-podman values using PODMAN_COMPOSE_* environment variables.
- Added support to set
--routeoption topodman network createviax-podman.routeskey on network configuration. - Implemented support for custom pod names in
--in-pod.
Changelog 1.6.0 (`docs/Changelog-1.6.0.md`)
Version 1.6.0 (2026-06-03)
Bug fixes
- Implemented volumes bind
create_host_pathoption. - Implemented colored, service-name-only default for
logscommand. - Added
--no-colorflag forpodman-compose logscommand. - Cleaned up error messages when external network or volume is missing, including a suggested
podman network create/podman volume createcommand. - Fixed crash on parsing empty top-level objects in compose file
- Images that have names starting with
localhost/will no longer be
pulled when both image and build sections exist. - Fixed link resolution for mounted volume when volume source is a symlink.
- Fixed
podman-compose down servicestops wrong dependents - Fixed the bug in parsing to add identify
extra-hostsfield in build parameters. - Fixed TypeError when parsing 'include' items that are formatted as detailed mappings (dictionaries).
- Fixed shell error:
unknown flag: --policy. - Fixed !reset and !override tags used used with extended compose file
- Fixed freeze caused by too long log lines containing multibyte characters.
- Fixed crash on merging named volumes with driver options into the uncustomized named volumes
- Fixed
--pulloption inbuildandupcommand can not set to pull policy explicitly. - Implemented returning error code from
pullcommand. - The
targetsuboption on mount-type external secrets is now honored. - Added support for service level configuration change detection on up command
- Fixed top-level
nameattribute interpolation not happening.
Changes
- Better error message when probing for podman fails.
- Renamed healthcheck flags to be consistent with Podman options.
Features
- Implemented --wait and --wait-timeout for podman-compose up and start.
- Added support for 'glob' mount type when defining volumes.
- Added support for COMPOSE_PROFILES environment variable to enable profiles.
- Added support for volume.type=image in services, for mounting files from container images.
- Added support for nested variable interpolation
- Images are now pull before container teardown on compose up, which reduce the downtime of services.
- Added support for
environmentas a secret source for build secrets. - Added support for
service:service_namecontexts inbuild.additional_contexts. - Add support for
start_intervaloption.
Extensions (`docs/Extensions.md`)
Podman specific extensions to the docker-compose format
Podman-compose supports the following extensions to the docker-compose format. These extensions
are generally specified under fields with "x-podman" prefix in the compose file.
Container management
The following extension keys are available under container configuration:
x-podman.uidmaps- Run the container in a new user namespace using the supplied UID mapping.x-podman.gidmaps- Run the container in a new user namespace using the supplied GID mapping.x-podman.rootfs- Run the container without requiring any image management; the rootfs of the
container is assumed to be managed externally.x-podman.no_hosts- Run the container without creating /etc/hosts filex-podman.passwd- Allow Podman to add entries to /etc/passwd and /etc/group when used in conjunction with the --user option. Defaults to true.
For example, the following docker-compose.yml allows running a podman container with externally managed rootfs.
version: "3"
services:
my_service:
command: ["/bin/busybox"]
x-podman.rootfs: "/path/to/rootfs"For explanations of these extensions, please refer to the Podman Documentation.
Secrets
The following extension keys are available under secret configuration:
x-podman.relabel - Configure SELinux relabelingFor example, the following configures custom-secret to use mount with private and unshared content.
Only the current container can use a private volume.
secrets:
custom-secret:
x-podman.relabel: ZFor explanations of these extensions, please refer to the podman-run --volume documentation).
Network management
The following extension keys are available under network configuration:
x-podman.disable_dns- Disable the DNS plugin for the network when set to 'true'.x-podman.dns- Specifies a list of nameservers for the network. This cannot be used with x-podman.disable_dns`.
For example, the following docker-compose.yml allows all containers on the same network to use the
specified nameservers:
version: "3"
network:
my_network:
x-podman.dns:
- "10.1.2.3"
- "10.1.2.4"x-podman.routes- Specifies a list of additional routes for the network. This corresponds to--routeoption inpodman network create.
For example, the following docker-compose.yml blocks network connectivity to specified subnet from
all containers on the network:
version: "3"
network:
my_network:
x-podman.routes:
- "10.2.3.4,127.0.0.1"For explanations of these extensions, please refer to the
Podman network create command Documentation.
Per-network MAC-addresses
Generic docker-compose files support specification of the MAC address on the container level. If the
container has multiple network interfaces, the specified MAC address is applied to the first
specified network.
Podman-compose in addition supports the specification of MAC addresses on a per-network basis. This
is done by adding a x-podman.mac_address key to the network configuration in the container. The
value of the x-podman.mac_address key is the MAC address to be used for the network interface.
Note that the compose spec
now supports mac_address on the network level, so we recommend using
the standard mac_address key for setting the MAC address. Thex-podman.mac_address is still supported for backwards compatibility.
Specifying a MAC address for the container and for individual networks at the same time is not
supported.
Example:
---
version: "3"
networks:
net0:
driver: "bridge"
ipam:
config:
- subnet: "192.168.0.0/24"
net1:
driver: "bridge"
ipam:
config:
- subnet: "192.168.1.0/24"
services:
webserver:
image: "busybox"
command: ["/bin/busybox", "httpd", "-f", "-h", "/etc", "-p", "8001"]
networks:
net0:
ipv4_address: "192.168.0.10"
x-podman.mac_address: "02:aa:aa:aa:aa:aa"
net1:
ipv4_address: "192.168.1.10"
mac_address: "02:bb:bb:bb:bb:bb" # mac_address is supportedPer-network interface name
Using x-podman.interface_name within a container's network config you can specify the interface name inside the container.
Podman-specific network modes
Generic docker-compose supports the following values for network-mode for a container:
bridgehostnoneservicecontainer
In addition, podman-compose supports the following podman-specific values for network-mode:
slirp4netns[:<options>,...]ns:<options>pasta[:<options>,...]private
The options to the network modes are passed to the --network option of the podman create command
as-is.
Podman-specific mount types
Generic docker-compose supports the following values for mount type:
volumebindtmpfs
In addition, podman-compose supports the following podman-specific values for mount type:
glob
Docker Compose Compatibility
podman-compose aims to be compatible with docker-compose, but there are some differences in
behavior and features. The following sections describe how to enable compatibility with docker-compose
and how to handle some of the differences.
Compatibility settings can either be set explicitly as described below, or by setting the docker_compose_compat meta
settings to true under the global x-podman key:
x-podman:
docker_compose_compat: trueThis will enable all compatibility settings described below, and is equivalent to setting each of them to true.
This setting can also be changed by setting the PODMAN_COMPOSE_DOCKER_COMPOSE_COMPAT environment variable.
Compatibility of name separators between docker-compose and podman-compose
Currently, podman-compose is using underscores (_ character) as a separator in names of
containers, images, etc., while docker-compose has switched to hyphens (- character). This setting
allows you to switch podman-compose to use hyphens as well.
To enable compatibility between docker-compose and podman-compose, specifyname_separator_compat: true under global x-podman key:
x-podman:
name_separator_compat: trueBy default name_separator_compat is false. This will change to true at some point and the
setting will be removed.
This setting can also be changed by setting PODMAN_COMPOSE_NAME_SEPARATOR_COMPAT environment
variable.
Compatibility of default network names between docker-compose and podman-compose
Current versions of podman-compose may produce different default external network names than
docker-compose under certain conditions. Specifically, docker-compose removes dashes (- character)
from project name.
To enable compatibility between docker-compose and podman-compose, specifydefault_net_name_compat: true under global x-podman key:
x-podman:
default_net_name_compat: trueBy default default_net_name_compat is false. This will change to true at some point and the
setting will be removed.
This setting can also be changed by setting PODMAN_COMPOSE_DEFAULT_NET_NAME_COMPAT environment
variable.
Compatibility of default network behavior between docker-compose and podman-compose
When there is no network defined (neither network-mode nor networks) in service,
The behavior of default network in docker-compose and podman-compose is different.
| Top-level networks | podman-compose | docker-compose |
|---|---|---|
| No networks | default | default |
| One network named net0 | net0 | default |
| Two networks named net0, net1 | podman(--network=bridge) |
default |
| Contains network named default | default | default |
To enable compatibility between docker-compose and podman-compose, specifydefault_net_behavior_compat: true under global x-podman key:
x-podman:
default_net_behavior_compat: trueThis setting can also be changed by setting PODMAN_COMPOSE_DEFAULT_NET_BEHAVIOR_COMPAT environment
variable.
Custom pods management
Podman-compose can have containers in pods. This can be controlled by the extension key x-podman in_pod.
It allows providing a custom value for --in-pod and is especially relevant when --userns has to be set.
For example, the following docker-compose.yml allows using userns_mode by overriding the default
value of --in-pod (unless it was specifically provided by "--in-pod=True" in command line interface).
version: "3"
services:
cont:
image: nopush/podman-compose-test
userns_mode: keep-id:uid=1000
command: ["dumb-init", "/bin/busybox", "httpd", "-f", "-p", "8080"]
x-podman:
in_pod: falseThis setting can also be changed by setting PODMAN_COMPOSE_IN_POD environment
variable.
It is also possible to override the default arguments for pod creation that are
used when --pod-args is not passed on the command line:
version: "3"
services:
cont:
image: nopush/podman-compose-test
command: ["dumb-init", "/bin/busybox", "httpd", "-f", "-p", "8080"]
x-podman:
pod_args: ["--infra=false", "--share=", "--cpus=1"]When not set in docker-compose.yml or on the command line, the pod args default
to ["--infra=false", "--share="].
This setting can also be changed by setting PODMAN_COMPOSE_POD_ARGS environment
variable.
Mappings (`docs/Mappings.md`)
Overview
1podfw- create all containers in one pod (inter-container communication is done vialocalhost), doing port mapping in that pod1pod- create all containers in one pod, doing port mapping in each container (does not work)identity- no mappinghostnet- use host network, and inter-container communication is done via host gateway and published portscntnet- create a container and use it via--network container:name(inter-container communication vialocalhost)publishall- publish all ports to host (using-P) and communicate via gateway
--- METRICS ---
- Files Extracted: 19
- Estimated Token Budget: ~7586 tokens
- Canonical Reference: https://codewiki.google/github.com/containers/podman-compose