Executive summary

Podman has released v6.2.0-RC1, a release candidate that gathers a lot of small but useful features in podman push, kube play, Quadlet, and the API, along with dozens of cross-platform bugfixes. What caught my attention were several clear deprecation signals: this is an RC that needs to be read, not just upgraded to blindly, because some old behavior is going away in Podman 7.0.

Problems solved

Several things that have long been awkward in Podman are addressed here. Pushing a multi-arch image always pushed the entire manifest list, even though sometimes we only want to push one specific platform to a registry that doesn't expect a manifest list. kube play also lacked control: there was no official way to reject unrecognized YAML fields, no way to set custom labels on the created resources, and if a Deployment had more than 1 replica, Podman would only create a single pod. On the Quadlet side, container umask configuration and the dependency strategy toward mount paths (RequiresMountsFor vs WantsMountsFor) couldn't be configured per-unit yet. And in general, API compatibility with Docker still has small gaps, such as a {} healthcheck being misinterpreted, or Compat endpoints not yet following the fields Docker expects.

Key features and code examples

The ones most immediately useful to me:

  • podman push --platform — push only a single platform-specific manifest, not the entire manifest list.
  • podman kube play --validate (#18332) — controls how unrecognized YAML fields are handled.
  • podman kube play --label (#26450) — sets labels on the container/pod/volume/secret created from the manifest.
  • podman kube play --multiple-pods (#26769) — creates multiple pods when a Deployment requests replicas > 1.
  • podman kube play --build can now build from a subdirectory context (#28148).
  • Quadlet .container has a new key Umask (#25278), and all Quadlet files have the key SetMountsDependency (#29946) to choose RequiresMountsFor, WantsMountsFor, or no dependency at all.
  • podman farm list --quiet / --noheading, and podman artifact ls --format=json / --quiet.
  • podman create --passwd — now has parity with podman run for adding an entry to /etc/passwd.
  • podman events --filter network= (#29387) to filter events per network.
  • podman auto-update now works on the remote client, plus a new --filter option to update only containers matching a specific filter.
  • StartInterval in image healthchecks is now actually honored (#27724), so the startup healthcheck interval from image metadata is applied.
  • podman image scp --compression-format / --compression-level (#23192) to compress during image transfer between hosts.
  • podman ps --sort can now sort by pod, and --filter status!= (#21398) to exclude specific statuses.

An illustration of using kube play with labels and multiple pods (a usage example, not from the source):

podman kube play \
  --validate=strict \
  --label app=myservice \
  --multiple-pods \
  deployment.yaml

And an example Quadlet .container with Umask and SetMountsDependency:

[Container]
Image=docker.io/library/nginx:latest
Umask=0027
SetMountsDependency=wants

Impact and upgrade notes

A few things worth noting before upgrading:

  • Build requirement raised: Podman now requires Go v1.26 or newer to build from source.
  • Seccomp config via annotation in kube play is officially deprecated — use securityContext.seccompProfile in the Kubernetes YAML instead. Support for the old annotation will be fully removed in Podman 7.0.
  • --cpu-rt-period and --cpu-rt-runtime in create/run/update/container clone are now hidden from the documentation (they've been non-functional since cgroups v1 was removed) and will be removed entirely in v7.
  • --health-startup-interval now has an alias, --health-start-interval.
  • The journald event driver no longer includes its own timestamp in the event log (#29835), since journald already has a built-in timestamp — this could affect tooling that parses the timestamp from that field.
  • --image-volume=bind now issues a warning since it's deprecated; the newly documented default is anonymous.
  • Container inspect carries new fields (DNSNames, IsInitCtr, InitContainerType, #29811) and Aliases now only contains DNS aliases added by the user (not all aliases) — if you have scripts reading Aliases raw, they need to be re-checked.
  • On the API side, there are new endpoints POST /libpod/autoupdate and GET /distribution/{name}/json (#17726), plus the field HostConfig.Mounts.TmpfsOptions.Options in Compat Create — relevant for those integrating directly with the REST API rather than through the CLI.

Since this is still an RC, I personally will wait for the bugfix list (which is fairly long, including issues with podman machine on Windows and --userns=keep-id) to settle before using it in production.

---

First announced at Podman releases. Read the original source for full details.

Read also