podman

Best Practices

• Use rootless containers by default for defense-in-depth security (no daemon, no root required)
• Define resource limits (memory, cpu) in Pod YAML spec.containers[].resources
• Use named volumes for persistent data instead of bind mounts in production
• Set security contexts with readOnlyRootFilesystem, runAsNonRoot, and drop ALL capabilities
• Map ports at the pod level (hostPort on pod spec) for external access to multi-container pods
• Use fully qualified image names with registry prefix (docker.io/library/nginx:1.25)
• Pin image versions to specific tags or SHA256 digests for reproducibility
• Use Quadlet files for systemd-managed production deployments with auto-restart and dependency ordering
• Configure health checks (HealthCmd in Quadlet, or livenessProbe/readinessProbe in Pod YAML)