Podman 6.0 rebuilt its networking stack. The thread was really about whether it can replace Compose
Podman's big release swaps its networking internals for Netavark, Pasta and nftables and adds experimental rootless port forwarding that keeps the real source IP. The teams that already switched came to talk about what made them leave Docker.
The pro-Podman case in the thread was security and ergonomics: no 'container root equals host root' games, no daemon, no holes punched in your firewall. One CTO switched after Docker Desktop ballooned in memory — 'literally as easy as installing it and pointing it at our docker-compose.yml.'
The honest counterweight was portability. Podman's file-per-unit Quadlet model can't match Compose's single, readable, shareable file for team development — and getting current versions on Ubuntu without stale distro repos still, one reader argued, keeps losing Podman to Docker.
What actually shipped in 6.0
Podman v6.0.0 (July 2, 2026) is a major release centered on modernizing networking: it moves defaults from slirp4netns and iptables toward Netavark, Pasta and nftables for easier maintenance, and adds an experimental rootless port-forwarding mode ("Pesto") that preserves the correct source IP on custom networks. Podman Machine gains multi-provider VM support and a podman machine os update command; Quadlets (systemd-based container units) pick up REST API support, better file tracking and more .volume features; and Docker API compatibility keeps improving to smooth migration. (The blog also, per a commenter, auto-migrates the bolt database to sqlite — worth confirming against the release notes.)
The real debate: security ergonomics vs. Compose's one file
The migration stories were concrete. Docker Desktop's memory behavior did the selling:
"After Docker Desktop randomly started consuming insane amounts of memory again we switched to Podman and it was literally as easy as installing it and pointing it at our docker-compose.yml. Zero changes needed and now I don't need to keep a daemon running." — the CTO and co-founder of Process Street
The pro-Podman case leaned hardest on security:
"no "container root" / "docker group" = "host root" shenanigans… podman doesn't spew garbage and punch holes in my firewall (iptables)" — a user citing rootless security as the reason to switch
But the counterweight named the thing Compose still does better:
"the beauty of compose is the same as the beauty of the Dockerfile. Portability, reproducibility (mostly), and a single readable file with all the relevant parts… How do people actually work with podman? Do you work with a team? How do you setup a local development stack the way you would with compose?" — a commenter questioning Podman's fit for team dev
And the adoption blocker that keeps outliving the feature list:
"As long as they refuse to support installing on Ubuntu (and other popular distros), without relying on the distro repos which are always out of date, they will continue to lose to Docker." — a reader on Podman's install friction
Six major versions in, Podman has clearly won the argument on architecture — rootless, daemonless, safer by default. What it still hasn't won is the argument that decides adoption: the developer who just wants one file they can hand a teammate, and a fresh binary that installs without a fight.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Vite+ wants to be the one toolchain for the whole web — and manage your Node runtime too
VoidZero, the team behind Vite, put its whole toolbox — builds, tests, bundling, linting, formatting — behind a single vp command. The reach into your global Node runtime is exactly where the thread got nervous.