Podman 6.0.0 Arrives: Shedding Legacy Weight for a Modern Container Era

The release of Podman v6.0.0 marks a defining moment for the open-source container engine. For years, Podman positioned itself as the drop-in, daemonless alternative to Docker, a goal that required carrying a massive amount of backward-compatibility baggage. To win over users on older enterprise systems, Podman had to support legacy networking, outdated control groups, and aging database backends.

With version 6.0.0, that era is officially over. Coinciding with its transition to a CNCF-owned GitHub organization and a new Go import path (go.podman.io/podman/v6), Podman has executed an aggressive, highly opinionated housecleaning. By dropping support for cgroups v1, slirp4netns, CNI, iptables, BoltDB, Intel Macs, and Windows 10, the project is drawing a line in the sand. If you want to use Podman, you must use modern container primitives.

For developers, this means a leaner, more secure local runtime with significantly better Docker API parity. But it also means you cannot simply run a lazy package upgrade without preparing for some breaking changes.

The Great Legacy Purge

Maintaining compatibility with obsolete Linux infrastructure has long hindered Podman's performance and security. The removal of these legacy technologies represents a massive reduction in technical debt:

• cgroups v1 is Gone: Podman now strictly requires cgroups v2. This allows for far better resource delegation and management, especially in rootless environments.
• Pasta Replaces slirp4netns: The slirp4netns tool was the bottleneck of rootless networking for years, plagued by high CPU overhead and latency. Pasta, which became the default in Podman 5.0, is now the sole rootless network stack. Along with this, the --network-cmd-path global option has been removed.
• Netavark and nftables Only: CNI networking support is completely removed in favor of Netavark. On the firewall side, iptables support is gone, making nftables a hard requirement. This streamlines how Podman configures host routing and reduces conflicts with modern system firewalls.
• BoltDB to SQLite Migration: Podman has dropped BoltDB. When you launch Podman 6.0.0, it will attempt to automatically migrate your local container database to SQLite. However, the maintainers warn that to ensure a seamless transition, users should first upgrade to Podman v5.8 and reboot before making the jump to v6.0.0.

Modernizing the Local Developer Loop

If you use Podman on macOS or Windows via podman machine, version 6.0.0 introduces major quality-of-life improvements alongside a few sharp edges.

First, the multi-provider experience has been unified. Previously, managing virtual machines across different hypervisors required juggling provider-specific commands. Now, all podman machine commands can operate on VMs from any provider, regardless of your active default. The active provider in your configuration now only dictates what provider is used when you run podman machine init. On macOS, the default machine provider has officially shifted to libkrun.

Keeping your local environment secure and updated is also much easier. A new command, podman machine os update (not supported on WSL), lets you update the guest operating system inside your VM directly from the host. Additionally, the new --import-native-ca flag allows Podman Machine to automatically pull your host system's trusted CA certificates into the VM, saving you from manual certificate-chaining headaches when working behind corporate proxies.

However, Linux developers using podman machine face an immediate breaking change. VMs on Linux now mount host volumes using systemd. This change breaks existing volume mounts on older Linux VMs, meaning you must recreate your machines after upgrading.

Quadlets and Advanced Networking

Quadlets, which allow you to manage containers as native systemd services, have received a significant architecture overhaul. Instead of tracking Quadlets and their associated files via a .app file, Podman now organizes them into dedicated subdirectories. This makes manual management of systemd-integrated containers far cleaner and less prone to tracking bugs. Quadlets also gain REST API support, expanded features for .volume units (including UID=, GID=, and Options= support), and new search paths to simplify distribution packaging.

For advanced networking, Podman 6.0.0 introduces experimental support for "Pesto" rootless port forwarding. Pesto solves a long-standing rootless container pain point: preserving the correct source IP address for incoming traffic on custom networks.

Furthermore, containers can now bind to multiple static IP addresses by passing the ip= option to --net multiple times. Administrators can also use podman network create to define blackhole, unreachable, and prohibit routes, giving you granular control over container egress traffic.

Aligning with the Docker Ecosystem

Podman 6.0.0 aggressively closes the behavioral gap with Docker, which means some commands will behave differently than they did in v5.x:

• Volume Pruning: The podman volume prune command now matches Docker's default behavior by only removing unused anonymous volumes. If you want to prune all unused volumes, you must explicitly pass the new --all flag. A highly welcome --dry-run option has also been added so you can preview what will be deleted.
• Container Commits: To mitigate security risks during concurrent modifications, podman commit now automatically pauses the container while creating the image. You can disable this with --pause=false if your workflow requires hot commits.
• Filter Logic: Commands like podman volume list and label-based filters now combine multiple filter instances using logical AND instead of logical OR.
• JSON Output: The --format='{{json .Labels}}' option for ps, pod pod ps, and volume ls now outputs comma-separated key=value pairs instead of a raw JSON map, aligning directly with Docker's output format.

On the security front, this release addresses CVE-2026-57231. This vulnerability allowed a malicious container image with malformed environment entries to leak host environment variables into the container using the * glob operator. Upgrading to 6.0.0 plugs this leak.

The Upgrade Checklist

Before you run your package manager to pull down Podman 6.0.0, run through this checklist to avoid breaking your local environment:

1. Verify Host Primitives: Ensure your Linux host is running cgroups v2 and has nftables installed. If you are on Fedora Project or Ubuntu, modern releases already default to these, but older LTS installations may need manual upgrades.
2. Migrate the DB First: If you are upgrading a machine with active containers, upgrade to Podman 5.8 first, let the BoltDB-to-SQLite migration complete, reboot, and then install 6.0.0.
3. Recreate Your VMs: If you are on macOS or Linux, back up any critical data inside your podman machine environments, delete them, and initialize new ones to adopt the new libkrun and systemd mount architectures.
4. Update Go Imports: If you maintain Go tools that integrate with Podman's API, update your import paths from github.com/containers/podman/v5 to go.podman.io/podman/v6 and ensure you are building with Go 1.25 or higher.

Podman 6.0.0 is a highly welcome modernization. By shedding legacy components, the project has delivered a faster, more secure, and highly predictable container engine that is finally ready to step out of Docker's shadow on its own terms.