Podman quadlet examples

Standalone containers

One .container file, usually with a .volume for its data. The simplest quadlet shape.

• whoami quadlet

  The hello world of quadlets: one tiny web server as a systemd user service.

• Lidarr next to an existing media pod

  Lidarr as a standalone quadlet that joins an existing media stack without touching the pod.

• Jellyfin with Intel Quick Sync

  A rootless Jellyfin media server with hardware transcoding on an Intel iGPU.

• Seerr (Jellyseerr) media requests

  A request page where Jellyfin users ask for films and series, handed to Radarr and Sonarr.

• AdGuard Home quadlet

  A network-wide DNS ad blocker as a rootful systemd service that starts at boot.

• Caddy reverse proxy quadlet

  Automatic HTTPS in front of your other containers, with certificates kept in a named volume.

• ntfy with systemd OnFailure alerts

  A private ntfy server plus one drop-in that sends a push alert whenever a user service fails.

• Gatus status page

  Uptime checks for every service, written as YAML, with a status page and ntfy alerts.

• Homepage dashboard with login

  A start page for every service, with live widgets and a login, and no docker socket.

• NetAlertX network monitor quadlet

  A LAN device scanner that alerts on new devices, using the host network and raw sockets.

• changedetection.io quadlet

  A website change monitor with its data in a named volume you can back up in one command.

Pods: several containers as one unit

A .pod file groups containers that share one network namespace, so they talk over localhost.

• Media stack pod: Radarr, Sonarr, Lidarr, Prowlarr, NZBGet, Bazarr

  Six media apps in one rootless pod that talk over localhost and share one /srv/media folder.

• UniFi Network Application and MongoDB pod

  An app and its database in one pod, with the passwords in podman secrets instead of the unit files.

Timer jobs: backups, syncs and alerts

A one-shot service that a systemd timer or an OnFailure= hook starts, runs once and exits.

• Recyclarr v8 on a systemd timer

  A daily one-shot sync of TRaSH guide profiles and minimum sizes into Radarr and Sonarr.

• restic backups with an offsite cloud copy

  Nightly restic snapshots of every container volume, plus a daily one-way copy to the cloud.

Rootless or rootful: which one?

Run a container rootless unless it needs something only root has: a port below 1024 (DNS on 53, HTTP on 80 and 443) or direct access to the host's network interfaces. A compromised rootless container only gets the rights of your user, not root's. For rootless services, turn on loginctl enable-linger so they start at boot without a login.

Have a docker-compose file or a docker run command instead? Convert it with the compose to quadlet converter or the docker run to quadlet converter, and check any unit with the systemd unit explainer.