Podman replaces Docker — no daemon, no root, no subscription

On September 12, 2024, Docker announced a sweeping overhaul of its subscription plans. The result: Docker Pro jumped from $5 to $9 per month, Docker Team from $9 to $15 per user per month. Docker Personal remains free — but with Docker Hub pull limits that kicked in on March 1, 2025. This was not Docker’s first licensing pivot: back on August 31, 2021, the company had already restricted free Docker Desktop usage to companies with fewer than 250 employees and under $10 million in revenue, pushing everyone else toward a paid subscription.

Podman has never cost a cent. As of May 6, 2026, the project holds 32,400 GitHub stars, 27,900 commits, and an Apache 2.0 license. It runs without a daemon, without root privileges, and its CLI is a drop-in replacement for Docker.

The daemon that costs money

Docker is built on a client-server architecture. A single daemon — dockerd — runs permanently as root, listens on a Unix socket (/var/run/docker.sock), and handles all operations. This model has three direct consequences:

• Security. Mounting docker.sock inside a container gives it root-equivalent access to the host. Any container that can write to that socket can escape and compromise the entire machine.
• Reliability. If the daemon crashes, every container becomes orphaned. No daemon, no containers — including the ones that were running perfectly fine.
• Cost. Since the licensing changes of 2021 and the pricing overhaul of 2024, Docker Desktop requires a paid subscription for any professional use. The cheapest plan — Docker Pro — is $9/month billed annually. That is $108 per year per developer. A five-person team pays $900/year for a container GUI.

Those $9 a month only buy access to Docker Desktop. The underlying Docker Engine remains free and open source — you are paying for the graphical interface, the cloud build features, vulnerability scanning, and unlimited Docker Hub pulls. But the alternative exists, and it costs nothing.

Podman, the daemonless architecture

Podman is an OCI container engine developed by Red Hat and maintained by the community under the CNCF umbrella. Its architectural difference from Docker is radical: there is no central daemon.

Every Podman container is a direct child process of the process that launched it — just like a classic fork + exec. No intermediate Unix socket, no central process to keep alive, no root privileges required. The result:

• Rootless by default. A Podman container launched by a non-privileged user runs with that user’s UID/GID inside a dedicated user namespace. The process inside the container believes it is root, but it is mapped to an unprivileged UID on the host. Even if the container escapes, the attacker lands with normal user permissions — not root.
• No single point of failure. If one Podman container crashes, the others keep running. There is no daemon to restart.
• Docker-compatible CLI. alias docker=podman works for 95% of use cases. podman run, podman build, podman pull, podman ps — the syntax is identical. Podman even supports docker-compose via podman-compose or the native Docker Compose backend since version 5.0.

Here is the same nginx + Redis stack in both syntaxes:

# Docker
docker run -d --name nginx -p 80:80 nginx:alpine
docker run -d --name redis -p 6379:6379 redis:alpine

# Podman — exactly the same
podman run -d --name nginx -p 80:80 nginx:alpine
podman run -d --name redis -p 6379:6379 redis:alpine

Podman Desktop, the free replacement

The most common justification for paying for Docker Desktop is its graphical interface. Podman Desktop delivers the same thing, for free, with broader functional coverage.

Podman Desktop is a desktop application (Linux, macOS, Windows) that manages all of your container engines — not just Podman. The interface lets you:

• List, start, stop, and inspect containers, images, volumes, and networks
• View real-time logs with syntax highlighting
• Manage Kubernetes pods natively — create, inspect, deploy
• Open a terminal inside any container with a single click
• Extend via plugins — private registries, Kind, Minikube, OpenShift
• Debug with direct access to metrics, volumes, and environment variables
• GPU acceleration for local AI workloads

The project is licensed under Apache 2.0 and hosted by the CNCF alongside Kubernetes itself. Nothing is locked behind a paywall — no pull limits, no «pro features» reserved for subscribers.

Quadlet, the native systemd integration

This is the killer feature for Linux servers. Docker starts containers at boot through its daemon, using restart policies (--restart=always) that are not native to systemd.

Quadlet is a systemd generator built into Podman since version 4.4. It converts declarative configuration files into native systemd units, with no intermediate daemon.

A concrete example. Here is how you run nginx at boot with Docker Compose:

# docker-compose.yml — depends on dockerd
services:
  nginx:
    image: nginx:alpine
    ports:
      - "80:80"
    restart: always

With Podman and Quadlet, the same service becomes a native systemd unit — nothing more than a text file dropped into /etc/containers/systemd/:

# /etc/containers/systemd/nginx.container
[Container]
Image=nginx:alpine
PublishPort=80:80

[Install]
WantedBy=default.target

A single systemctl daemon-reload and systemctl start nginx is all it takes. The container is managed by systemd like any other Linux service — systemctl status nginx, journalctl -u nginx, systemctl enable nginx. No Docker daemon to supervise, no YAML sprawl to maintain, no Compose plugin to install.

Quadlet supports .container, .volume, .network, .pod, .kube, .build, and .image files. It handles inter-service dependencies, cgroup resource limits, environment variables, secrets, and automatic updates (podman auto-update). It is the cleanest way to run containers in production on a standard Linux server — no Kubernetes, no swarm, no heavy orchestration required.

Native Kubernetes pods

Docker has no concept of a pod. A Kubernetes pod is a group of containers that share the same network namespace, the same volumes, and the same lifecycle. Podman implements pods natively — without installing Kubernetes.

# Create a pod with shared networking
podman pod create --name webapp -p 8080:80

# Add containers to the pod
podman run -d --pod webapp --name nginx nginx:alpine
podman run -d --pod webapp --name redis redis:alpine

# Export the pod as Kubernetes YAML
podman generate kube webapp > webapp-pod.yaml

# Redeploy it elsewhere or later
podman play kube webapp-pod.yaml

This pod → kube → pod loop is a direct bridge between local development and a production Kubernetes cluster. You develop with local pods, export the manifest, and deploy it to your cluster without touching a line of YAML.

Migration in practice

Migrating from Docker to Podman takes three commands:

# Install Podman (Ubuntu/Debian)
sudo apt install podman

# Alias to preserve muscle memory
alias docker=podman

# Docker Compose compatibility
sudo apt install podman-compose
# or use the native backend: podman compose (Podman 5.0+)

Images built with docker build are OCI-compatible — they run on Podman without changes. Registries (Docker Hub, GHCR, Quay, private registries) are accessible with podman pull just like docker pull. Named volumes, bridge networks, and environment variables work identically.

What does not transfer directly:

• docker-compose with conditional depends_on. Podman-compose partially supports it — prefer Quadlet for multi-container workloads in production.
• BuildKit. Podman uses Buildah as its build backend, which covers almost all Dockerfile syntax but not BuildKit-proprietary features (advanced cache mounts, --mount=type=ssh).
• Swarm. Podman does not replace Docker Swarm. For orchestration, use Kubernetes, Nomad, or Quadlet across multiple machines with external supervision.
• Docker Desktop on macOS/Windows. Podman Desktop covers the same need, with an integrated Linux VM. The migration is transparent for the end user.

Comparison table

The bottom line

Switch to Podman if you run Linux servers, if security and container isolation matter to you, if you want clean systemd integration through Quadlet, or if you are preparing a Kubernetes migration — Podman pods are the shortest path from your laptop to your cluster.

Stick with Docker if your team already runs Docker Desktop and the $9/month per developer is less than the opportunity cost of migrating, if you depend on BuildKit for advanced Dockerfiles, or if your stack relies on Docker Swarm — Podman has no direct equivalent there.

The switch is simpler than it looks. alias docker=podman covers most of your daily workflow. The only real migration cost is learning Quadlet to replace restart: always and docker-compose in production — but that learning curve buys you containers without a daemon, without root, and without a subscription in return. For a homelab or a small business, the math is straightforward: $0 vs. $9 per month per developer, with better security and a simpler architecture.

References

• Podman — Official Site — accessed May 6, 2026
• Podman GitHub Repository — 32.4k stars, 27,900 commits, Apache 2.0
• Podman Desktop — CNCF desktop GUI, cross-platform, free
• Podman Documentation — Quadlet — native systemd generator
• Docker Pricing — Pro $9/mo, Team $15/mo, Business $24/mo (annual billing)
• Docker — Updated Subscriptions Announcement — September 12, 2024
• Red Hat — What is Podman? — accessed May 6, 2026
• Docker — Licensing FAQ — accessed May 6, 2026