Features

• The podman push command now supports a new option, --platform, which selects and pushes a single platform-specific manifest instead of the entire list.
• The podman kube play command now supports a new option, --validate, which determines how unrecognized YAML fields are handled (#18332).
• The podman kube play command now supports a new option, --label, to set labels on created containers, pods, volumes, and secrets (#26450).
• The podman kube play command can now create multiple pods if more than 1 replica is requested by a deployment using the new --multiple-pods option (#26769).
• The podman kube play --build command now supports building images from subdirectories of the main context directory (#28148).
• Quadlet .container files now support a new key, Umask, to set the default umask for the created container (#25278).
• All Quadlet files now support a new key, SetMountsDependency, configuring whether the generated unit will use RequiresMountsFor, WantsMountsFor, or no dependency at all on required source paths (#29946).
• The podman farm list command now supports two new options, --quiet, which will print only the names of active farms, and --noheading, which omits column headers from the output.
• The podman artifact ls command now supports two new options, --format=json, which will output machine-readable JSON, and --quiet, which prints only artifact digests.
• The podman create command now supports a new option, --passwd, to add entries to /etc/passwd in the container (this has previously been available with podman run).
• The podman info command now includes detailed information on the features supported by OCI runtimes.
• The podman events --filter command now supports a new filter, network=, to filter to events pertaining to a specific network (#29387).
• The podman auto-update command has been enabled on the remote Podman client.
• The StartInterval field in image healthcheck configuration is now respected, allowing images to configure startup healthchecks (#27724).
• The podman image scp command now supports two new options, --compression-format and --compression-level, to compress data during transfer (#23192).
• The podman auto-update command now supports a new option, --filter, to selectively update only containers that match the given filters.
• The podman ps --sort command now allows sorting by pod.
• The podman ps --filter command now supports a new filter, status!, which matches containers not in the given state (#21398).

Changes

• Podman now requires Go v1.26 or higher to build.
• The podman kube play command now uses the securityContext.seccompProfile fields in Kubernetes YAML for Seccomp configuration. Support for the existing annotation-based configuration of Seccomp is now deprecated, and will be removed with Podman 7.0.
• The podman inspect command on containers now includes three new fields, DNSNames (containing all names the container can be accessed via), IsInitCtr (whether the container is an init container), and InitContainerType (what type of init container this is, if it is one) (#29811).
• The podman inspect command on containers now only includes user-added DNS aliases in the Aliases field, which previously displayed all DNS aliases, improving Docker compatibility.
• The podman inspect command on containers now properly populates the ConsoleSize field for running containers (#28368).
• Systemd units created by Podman healthchecks are now named much more clearly (libpod-healthcheck-$CONTAINERID-$randsuffix.service) (#29373).
• Signal proxying is now enabled for attached podman exec commands. As such, killing a podman exec command with Control-C or similar should now also kill the processes started in the container (similar to how podman run already works) (#19486).
• The deprecated --cpu-rt-period and --cpu-rt-runtime options for podman create, podman run, podman update, and podman container clone are now hidden and undocumented. They have not been functional since the removal of cgroups v1 support and will be removed entirely in Podman v7.
• The --health-startup-interval option to podman create, podman run, and podman update has a new alias, --health-start-interval.
• When a startup healthcheck interval is specified, but no startup healthcheck command, the standard healthcheck command will be used instead.
• When using the journald event driver, timestamps are no longer included in logged events, as journald includes a timestamp already (#29835).
• Quadlet can now create template instances from instance-specific drop-in directories without requiring an explicit instance file or symlink (#27636).

Bugfixes

• Fixed a bug where passing an empty file to the --ignorefile option to podman build would cause the .dockerignore or .containerignore file in the context directory to be used, instead of not using an ignorefile at all (#25147).
• Fixed a bug where the Pod= key in Quadlet .container files did not expand the %N specifier (#29108).
• Fixed a bug where containers created with --userns=auto would report having a private user namespace in podman inspect after they started, but not when they were first created.
• Fixed a bug where logging was configured too late in the Podman init process to print errors from parsing configuration files (#25362).
• Fixed a bug where the podman system prune --build command could fail if a build container was removed while it was running.
• Fixed a bug where copy events from podman machine cp were not properly displayed by the remote Podman client.
• Fixed a bug where the podman farm build --tag command would fail if given a tag including a colon (#25039).
• Fixed a bug where the podman machine init --image command would fail when given a read-only disk image.
• Fixed a bug where the podman machine start and podman machine init --now commands could hang on Windows systems using the Hyper-V provider if the VM failed to start (#29455).
• Fixed a bug where the podman machine start command on Windows (both Hyper-V and WSL providers) would sometimes fail due to leftover processes from previous machines (#29474).
• Fixed a bug where the podman machine start command could hang indefinitely if the VM failed to start properly (#29880).
• Fixed a bug where the podman machine start command could create a VM that cannot be connected to on Windows if the host was shut down or restarted when the VM was running (#29971).
• Fixed a bug where the podman machine init command on Windows when using the Hyper-V provider did not correctly detach the file server process, causing VMs to lose access to host shares when the console that ran podman machine init closed (#29573).
• Fixed a bug where the podman kube play command incorrectly handled emptyDir volumes with medium: Memory, causing them to not be shared between containers in the pod and to ignore the sizeLimit parameter (#29555).
• Fixed a bug where the remote Podman client's podman kube play command incorrectly handled authentication credentials in API requests.
• Fixed a bug where volumes created by the podman volume import command would not adjust their permissions on being mounted into a container (#25442).
• Fixed a bug where the podman build command could leak temporary directories if a build failed (#22642).
• Fixed a bug where containers created with --userns=keep-id would use an image-specified user instead of forcing the same UID/GID in use on the host (#29600).
• Fixed a bug where the remote Podman client could not function when connecting over SSH to a server which does not support the direct-streamlocal channel type (#27814).
• Fixed a bug where the remote Podman client's podman push, podman artifact push, and podman manifest push commands would push an unsigned image instead of failing when the --sign-by or --sign-by-sigstore-private-key options were used.
• Fixed a bug...

Bugfixes

• Fixed an issue where Podman would not function when run under WSL 3 (#29749).

Misc

• Updated gvproxy to v0.9.0, resolving CVE-2026-107935
• Updated Buildah to v1.45.2
• Updated Storage to v1.64.2

Bugfixes

• Fixed an issue where Podman would not function when run under WSL 3 (#29749).
• Fixed a bug with podman machine VMs on Mac where machines could be left in an inconsistent state if the podman machine start command was interrupted by a signal.

Misc

• Updated gvproxy to v0.9.0, resolving CVE-2026-107935
• Updated Buildah to v1.43.5
• Updated Storage to v1.62.2

Security

• This release addresses CVE-2026-94603, where a podman run on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created.

Breaking Changes

• Removed support for checkpoint images in podman run due to serious security concerns with the different security models of running images and running checkpoints. Checkpoints ignore user-specified security configuration and are very difficult to run safely.

• This release addresses CVE-2026-94603, where a podman run on a checkpoint image (any image with the io.podman.annotations.checkpoint.runtime.name annotation) could disable all sandboxing, including sandboxing specified by the user, when the container was created.

Breaking Changes

• Removed support for checkpoint images in podman run due to serious security concerns with the different security models of running images and running checkpoints. Checkpoints ignore user-specified security configuration and are very difficult to run safely.

Security

• This release addresses (CVE-2025-11395), where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host.
• This release also addresses CVE-2026-79699 and CVE-2026-79705, though we do not believe these CVEs are exploitable through the Podman command line.

Misc

• Updated Buildah to v1.43.4
• Updated Common to v0.67.2
• Updated Image to v5.39.3
• Updated Storage to v1.62.1

Security

• This release addresses (CVE-2025-11395), where importing images containing crafted layer tarballs with the podman load command, or importing volumes containing crafted symlinks with podman volume import, allows overwriting files on the host.
• This release also addresses CVE-2026-79699 and CVE-2026-79705, though we do not believe these CVEs are exploitable through the Podman command line.

Misc

• Updated Buildah to v1.45.1
• Updated Common to v0.69.2
• Updated Image to v5.41.2
• Updated Storage to v1.64.1

Security

• This release addresses CVE-2026-17106, where a crafted tar archive could write outside the extraction directory through the use of malicious links (GHSA-hfg8-hc9c-6c3h).

Bugfixes

• Fixed broken rootlessport bind behavior with -p 0.0.0.0:... -p [::]:... which failed instead of binding both v4 and v6 separately. Podman Machine on WSL should now correctly forward ports again by binding separate IPv4 and IPv6 sockets to make the WSL forwarder logic work again (#29377).

Security

• This release addressed CVE-2026-19730 where the podman quadlet install --replace command did not truncate the file being replaced, meaning replacing a longer file with a shorter one would result in content from the original file incorrectly being retained.

Features

• A new command has been added, podman volume rename, to allow renaming volumes. Volumes created using volume drivers and volumes that are currently used by a container cannot be renamed (#28189).
• A new command has been added, podman machine restart, to allow easy restart of VMs managed by podman machine (#28366).
• The podman network rm command now includes a new option, --ignore, which suppresses errors when attempting to remove networks that do not exist (#28363).
• The podman manifest push command now includes two new options, --retry and --retry-delay, which allow pushes to be automatically retried on failure (#28590).
• Quadlet .container units now support a new key, ImageVolume=, to configure how volumes from images are handled (#28875).
• The podman generate kube command now includes support for generating container healthchecks as a livenessProbe (#22095).
• A new option, force_port_listen, has been added to containers.conf. This is required to be set when running Podman on WSL to support port forwarding from the Windows host. It is automatically set on newly-created podman machine VMs on Windows using the WSL provider.

Changes

• The podman info command now includes free memory available on the host (in addition to used memory and total memory) (#29116).
• The Pesto rootless port forwarding tool now supports IPv6 port forwarding with source IP preservation.

Bugfixes

• Fixed a bug where the remote Podman client could hang on some operations when connecting to a remote Podman service over SSH (#28453).
• Fixed a bug where the podman image scp command could not be used with usernames containing an @ character (#27655).
• Fixed a bug where the podman kube play command did not properly validate requested hostPort bindings, allowing the creation of containers with duplicated host ports which would never be able to start at the same time (#26622).
• Fixed a bug where podman machine VMs on Windows created using the hyperv provider would sometimes not properly start due to a race conditioning setting up volume mounts.
• Fixed a bug where podman machine VMs on Mac where machines could be left in an inconsistent state if the podman machine start command was interrupted by a signal.
• Fixed a bug where creating a container on a podman machine VM on Mac that attempted to bind to a port number number 1024 would return a nonsensical error message; a clear error explaining that privileged ports cannot be bound is now returned.
• Fixed a bug where the podman quadlet list and podman quadlet rm commands did not function properly with uninstantiated template Quadlets.
• Fixed a bug where the podman quadlet install command would occasionally fail to install a Quadlet if non-quadlet files were specified.
• Fixed a bug where the podman quadlet install command would not refuse to install Quadlets including non-quadlet files if the --application option was not specified.
• Fixed a bug where healthcheck logs could be corrupted, preventing proper healthcheck operation, if a healthcheck was killed midway through writing the file.
• Fixed a bug where the podman volume prune --all command incorrectly discarded label filters, causing podman volume prune --all --filter label=foo to prune all volumes, not just those with the foo label.
• Fixed a bug where the podman events --format=json command would print null instead of an error when the server sent an event that could not be decoded.
• Fixed a bug where a race condition could cause Quadlet to generate corrupt systemd units (#29004).
• Fixed a bug where the podman inspect command on a container with a single-element command (e.g. podman run fedora bash) would include the command in both Path and Args, when it should only have been included in Path (#29155).
• Fixed a bug where the --format option to podman inspect on containers did not properly support some format specifiers supported by Docker (e.g. {{.HostIp}} did not work, but {{.HostIP}} did) (#29164).
• Fixed a bug where the Quadlet generator would not write error messages to STDERR but only to /dev/kmsg, meaning that errors were not visible from systemd-analyze --generators verify and other tooling invoking the systemd generator directly.
• Fixed a bug where containers which failed to start would, in some circumstances, not properly clean up, resulting in improper behavior (#26143).
• Fixed a bug where the podman kube generate command would improperly generate warning messages only applicable when running as a rootless user on an SELinux enabled system when not running in that configuration (#17743).

API

• Fixed a bug where the Compat and Libpod Create endpoint for Exec Sessions (/containers/$CID/exec) did not honor the ConsoleSize parameter in the exec config.
• The Compat API has seen further changes to improve support for the Docker v1.44 API, including the deprecation of several fields removed in that release.
• Preparations have begun to implement support for the v1.45 API.

Misc

• Updated Buildah to v1.45.0
• Updated the image library to v5.41.1
• Updated the storage library to v1.64.0
• Updated the common library to v0.69.1