# 编辑containers.conf
$ sudo vi /etc/containers/containers.conf

[containers]
# 默认能力
default_capabilities = [
“CHOWN”,
“DAC_OVERRIDE”,
“FOWNER”,
“FSETID”,
“KILL”,
“NET_BIND_SERVICE”,
“SETFCAP”,
“SETGID”,
“SETPCAP”,
“SETUID”,
]

# 默认sysctls
default_sysctls = [
“net.ipv4.ping_group_range=0 0”,
]

# 日志驱动
log_driver = “journald”

# 日志大小限制
log_size_max = -1

# 默认超时
stop_timeout = 10

[engine]
# 运行时
runtime = “runc”

# 并发下载数
image_parallel_copies = 0

# 网络后端
network_backend = “cni”

# 默认命名空间
namespace = “”

# 镜像默认传输
image_default_transport = “docker://”

# 事件日志
events_logger = “journald”

网络配置

# 查看默认网络
$ podman network ls

输出示例如下：
NETWORK ID NAME DRIVER
88483c76d7e3 podman bridge

# 创建自定义网络
$ podman network create –driver bridge –subnet 172.20.0.0/16 –gateway 172.20.0.1 fgedu_net

输出示例如下：
fgedu_net

# 查看网络详情
$ podman network inspect fgedu_net

输出示例如下：
[
{
“cniVersion”: “1.0.0”,
“name”: “fgedu_net”,
“plugins”: [
{
“type”: “bridge”,
“bridge”: “cni-podman1”,
“ipam”: {
“type”: “host-local”,
“ranges”: [
[
{
“gateway”: “172.20.0.1”,
“subnet”: “172.20.0.0/16”
}
]
],
“routes”: [
{
“dst”: “0.0.0.0/0”
}
]
}
}
]
}
]

# 搜索镜像
$ podman search nginx

输出示例如下：
INDEX NAME DESCRIPTION
docker.io docker.io/library/nginx Official build of Nginx.
docker.io docker.io/bitnami/nginx Bitnami nginx Docker Image
docker.io docker.io/ubuntu/nginx Nginx, a high performance reverse proxy…

# 拉取镜像
$ podman pull docker.io/library/nginx:latest

输出示例如下：
Trying to pull docker.io/library/nginx:latest…
Getting image source signatures
Copying blob sha256:abc123def456…
Copying config sha256:def456ghi789…
Writing manifest to image destination
Storing signatures
def456ghi789jkl012mno345pqr678stu901vwx234yza567bcd890

# 查看本地镜像
$ podman images

输出示例如下：
REPOSITORY TAG IMAGE ID CREATED SIZE
docker.io/library/nginx latest def456ghi789 2 days ago 146 MB

# 给镜像打标签
$ podman tag docker.io/library/nginx:latest fgedu-nginx:v1

# 删除镜像
$ podman rmi docker.io/library/nginx:latest

# 导出镜像
$ podman save -o nginx.tar docker.io/library/nginx:latest

# 导入镜像
$ podman load -i nginx.tar

步骤2：运行容器

# 运行简单容器
$ podman run -d –name nginx-test -p 8080:80 docker.io/library/nginx:latest

输出示例如下：
abc123def456789012345678901234567890123456789012345678901234

# 查看运行中的容器
$ podman ps

输出示例如下：
CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES
abc123def456 docker.io/library/nginx:latest /docker-entrypoin… 5 seconds ago Up 4 seconds ago 0.0.0.0:8080->80/tcp nginx-test

# 查看所有容器（包括停止的）
$ podman ps -a

# 查看容器日志
$ podman logs nginx-test

输出示例如下：
2026/04/04 10:00:00 [notice] 1#1: using the “epoll” event method
2026/04/04 10:00:00 [notice] 1#1: nginx/1.25.4
2026/04/04 10:00:00 [notice] 1#1: built by gcc 12.2.0 (Debian 12.2.0-14)
2026/04/04 10:00:00 [notice] 1#1: OS: Linux 5.14.0-362.el9.x86_64
2026/04/04 10:00:00 [notice] 1#1: getrlimit(RLIMIT_NOFILE): 1073741816:1073741816

# 进入容器
$ podman exec -it nginx-test /bin/bash

# 停止容器
$ podman stop nginx-test

# 启动容器
$ podman start nginx-test

# 删除容器
$ podman rm nginx-test

步骤3：容器资源限制

# 运行带资源限制的容器
$ podman run -d \
–name web-app \
–memory=512m \
–memory-swap=1g \
–cpus=1.5 \
–cpu-shares=512 \
–pids-limit=100 \
-p 8080:80 \
docker.io/library/nginx:latest

输出示例如下：
def456ghi789012345678901234567890123456789012345678901234567

# 查看容器资源使用
$ podman stats web-app

输出示例如下：
ID NAME CPU % MEM USAGE / LIMIT MEM % NET IO BLOCK IO PIDS
def456ghi789 web-app 0.01% 5.5MB / 512MB 1.07% 1.2kB / 0B 0B / 0B 2

# 查看容器详情
$ podman inspect web-app

输出示例如下：
[
{
“Id”: “def456ghi789…”,
“Created”: “2026-04-04T10:00:00.000000000Z”,
“Path”: “/docker-entrypoint.sh”,
“Args”: [
“nginx”,
“-g”,
“daemon off;”
],
“State”: {
“Status”: “running”,
“Running”: true,
“Paused”: false,
“Pid”: 12345
},
“HostConfig”: {
“Memory”: 536870912,
“MemorySwap”: 1073741824,
“CpuShares”: 512,
“CpuQuota”: 150000,
“PidsLimit”: 100
}
}
]

# 创建Pod
$ podman pod create –name fgedu-pod -p 8080:80

输出示例如下：
abc123def456789012345678901234567890123456789012345678901234

# 查看Pod列表
$ podman pod ls

输出示例如下：
POD ID NAME STATUS CREATED INFRA ID # OF CONTAINERS
abc123def456 fgedu-pod Created 10 seconds ago def456ghi789 1

# 查看Pod详情
$ podman pod inspect fgedu-pod

输出示例如下：
{
“Id”: “abc123def456789012345678901234567890123456789012345678901234”,
“Name”: “fgedu-pod”,
“Created”: “2026-04-04T10:00:00.000000000Z”,
“State”: “Created”,
“Hostname”: “”,
“CreateCommand”: [
“podman”,
“pod”,
“create”,
“–name”,
“fgedu-pod”,
“-p”,
“8080:80”
],
“Containers”: [
{
“Id”: “def456ghi789…”,
“Name”: “abc123def456789-infra”,
“State”: “configured”
}
]
}

步骤2：在Pod中运行容器

# 在Pod中添加Nginx容器
$ podman run -d –pod fgedu-pod –name nginx \
docker.io/library/nginx:latest

输出示例如下：
ghi789jkl012345678901234567890123456789012345678901234567890

# 在Pod中添加应用容器
$ podman run -d –pod fgedu-pod –name web-app \
-e APP_ENV=production \
docker.io/library/python:3.11-slim \
python -m http.server 8081

输出示例如下：
jkl012mno345678901234567890123456789012345678901234567890123

# 查看Pod中的容器
$ podman ps –pod

输出示例如下：
CONTAINER ID IMAGE COMMAND POD ID NAMES
def456ghi789 k8s.gcr.io/pause:3.9 abc123def456 abc123def456789-infra
ghi789jkl012 docker.io/library/nginx:latest /docker-entrypoin… abc123def456 nginx
jkl012mno345 docker.io/library/python:3.11-slim python -m http.se… abc123def456 web-app

# 启动Pod
$ podman pod start fgedu-pod

# 停止Pod
$ podman pod stop fgedu-pod

# 删除Pod
$ podman pod rm fgedu-pod

步骤3：生成Kubernetes YAML

# 生成Kubernetes Pod YAML
$ podman generate kube fgedu-pod > fgedu-pod.yaml

# 查看生成的YAML
$ cat fgedu-pod.yaml

输出示例如下：
apiVersion: v1
kind: Pod
metadata:
creationTimestamp: “2026-04-04T10:00:00Z”
labels:
app: fgedu-pod
name: fgedu-pod
spec:
containers:
– image: docker.io/library/nginx:latest
name: nginx
ports:
– containerPort: 80
hostPort: 8080
protocol: TCP
resources: {}
– args:
– python
– -m
– http.server
– “8081”
env:
– name: APP_ENV
value: production
image: docker.io/library/python:3.11-slim
name: web-app
resources: {}
hostname: fgedu-pod
status: {}

# 从YAML创建Pod
$ podman play kube fgedu-pod.yaml

# 创建存储卷
$ podman volume create fgedu-data

输出示例如下：
fgedu-data

# 查看存储卷列表
$ podman volume ls

输出示例如下：
DRIVER VOLUME NAME
local fgedu-data

# 查看存储卷详情
$ podman volume inspect fgedu-data

输出示例如下：
[
{
“Name”: “fgedu-data”,
“Driver”: “local”,
“Mountpoint”: “/var/lib/containers/storage/volumes/fgedu-data/_data”,
“CreatedAt”: “2026-04-04T10:00:00.000000000Z”,
“Labels”: {},
“Scope”: “local”,
“Options”: {}
}
]

# 使用存储卷运行容器
$ podman run -d \
–name mysql-server \
-v fgedu-data:/var/lib/mysql \
-e MYSQL_ROOT_PASSWORD=root123 \
docker.io/library/mysql:8.0

输出示例如下：
mno345pqr678901234567890123456789012345678901234567890123456

# 挂载主机目录
$ podman run -d \
–name web-server \
-v /fgeudb/web:/usr/share/nginx/html:ro \
-p 8080:80 \
docker.io/library/nginx:latest

# 删除存储卷
$ podman volume rm fgedu-data

步骤2：systemd集成

# 生成systemd服务文件
$ podman generate systemd –name nginx-test –files –new

输出示例如下：
/home/fgedu/container-nginx-test.service

# 查看生成的服务文件
$ cat /home/fgedu/container-nginx-test.service

输出示例如下：
[Unit]
Description=Podman container-nginx-test.service
Documentation=man:podman-generate-systemd(1)
Wants=network-online.target
After=network-online.target
RequiresMountsFor=%t/containers

[Service]
Environment=PODMAN_SYSTEMD_UNIT=%n
Restart=on-failure
TimeoutStopSec=70
ExecStart=/usr/bin/podman run \
–cidfile=%t/%n.ctr-id \
–cgroups=no-conmon \
–rm \
–sdnotify=conmon \
-d \
–name nginx-test \
-p 8080:80 \
docker.io/library/nginx:latest
ExecStop=/usr/bin/podman stop \
–ignore \
–cidfile=%t/%n.ctr-id \
-t 10
ExecStopPost=/usr/bin/podman rm \
–ignore \
-f \
–cidfile=%t/%n.ctr-id
Type=notify
NotifyAccess=all

[Install]
WantedBy=default.target

# 复制服务文件
$ sudo cp /home/fgedu/container-nginx-test.service /etc/systemd/system/

# 启用并启动服务
$ sudo systemctl daemon-reload
$ sudo systemctl enable container-nginx-test.service
$ sudo systemctl start container-nginx-test.service

# 查看服务状态
$ sudo systemctl status container-nginx-test.service

输出示例如下：
● container-nginx-test.service – Podman container-nginx-test.service
Loaded: loaded (/etc/systemd/system/container-nginx-test.service; enabled)
Active: active (running) since Thu 2026-04-04 10:00:00 CST; 5s ago