cockpit-podman: manage rootless containers in Cockpit

Install and open the page

sudo zypper install cockpit-podman        # needs root; pulls in podman if missing

Reload Cockpit in the browser and "Podman containers" appears in the menu. It lists containers, pods and images, with CPU and memory per container, and has a filter to show everything or only running containers.

The podman API socket

Podman has no daemon, but it has an API that systemd starts on demand through a socket. cockpit-podman talks to that API, once for root and once for your user:

sudo systemctl enable --now podman.socket          # root's containers (needs root)
systemctl --user enable --now podman.socket        # your own rootless containers

If a socket is off, the page shows a notice with a button to start it, which does the same. Enabling the socket costs nothing while unused: like Cockpit itself, the API service only runs while something talks to it.

Both sockets on a machine where they are listening. The user socket belongs to UID 1000:

$ systemctl --user status podman.socket --no-pager | head -7
● podman.socket - Podman API Socket
     Loaded: loaded (/usr/lib/systemd/user/podman.socket; disabled; preset: disabled)
     Active: active (listening) since Fri 2026-09-25 12:52:21 CEST; 2 days ago
 Invocation: 4ccd38d3a31d44a99ffc929d8719d239
   Triggers: ● podman.service
       Docs: man:podman-system-service(1)
     Listen: /run/user/1000/podman/podman.sock (Stream)
$ systemctl status podman.socket --no-pager | head -3
● podman.socket - Podman API Socket
     Loaded: loaded (/usr/lib/systemd/system/podman.socket; disabled; preset: disabled)
     Active: active (listening) since Fri 2026-09-25 12:52:18 CEST; 2 days ago

Whose containers you see

This trips up the recommended setup from the rootless podman guide: your containers run as a separate user, say apps, and your admin login does not see them. To manage them in Cockpit, log in as apps, which needs a password for that user (sudo passwd apps). If you would rather keep apps key-only, use the Terminal page and sudo machinectl shell apps@.

The version of the page and the socket state as systemd lists them:

$ rpm -q cockpit-podman
cockpit-podman-129-1.1.noarch
$ systemctl list-units --no-pager --no-legend --type=socket podman.socket
  podman.socket  loaded active listening Podman API Socket

What the page is good at

• A quick look: what runs, how much memory it uses, whether a health check fails.
• Logs and a console per container, without remembering container names.
• Images: pull a new one, see which are unused, prune them.
• Pods: the containers that belong together, shown as a group.

The "Create container" dialog is handy for trying an image. What it creates is a plain container, though, not a service: nothing restarts it after a reboot unless you set a restart policy there, and it is not written down anywhere. For anything you want to keep, write a quadlet; the docker run to quadlet converter turns the command from a project's README into one.

Quadlets on the podman page

Recent cockpit-podman versions read the generated quadlet units and list those containers too, including stopped ones, for root and for the logged-in user. You can inspect them and read their logs there. Start, stop and restart them as services, though: systemd owns a quadlet container, and a stop from the podman page leaves the service in a state systemd did not ask for. The next guide shows how, and Cockpit links from a quadlet's service page straight to its container.

Frequently asked questions