Running Podman containers as systemd services with Quadlet

Goal

Define a Podman-managed container as a native systemd service using a Quadlet .container unit file, instead of the older generated-unit approach.

Prerequisites

Podman 4.4 or later (the first upstream release with the Quadlet generator; check podman --version, as older enterprise releases may lack it or have fewer keys); systemd on the host. Root for a system-wide service, or an ordinary user account (plus lingering, if it must run without a login session) for a rootless one.

Steps

1. Understand the mechanism first: podman-systemd.unit(5) documents Quadlet as a systemd generator that converts declarative .container files (and .volume, .network, .pod, .kube, .image, .build) into regular .service units at boot or on daemon-reload, rather than requiring a separately maintained generated unit file.
2. Do not use podman generate systemd for new services: its own manual page marks the command deprecated and recommends Quadlet.
3. Place a system-wide unit at /etc/containers/systemd/myapp.container, or a per-user one at ~/.config/containers/systemd/myapp.container (other search paths are listed in the manual). A minimal example:

[Unit]
Description=My application container

[Container]
Image=docker.io/library/nginx:stable
PublishPort=8080:80
AutoUpdate=registry

[Service]
Restart=on-failure

[Install]
WantedBy=multi-user.target

For a rootless (user) unit use WantedBy=default.target; the user manager has no multi-user.target. 4. Make systemd regenerate units from the new file: sudo systemctl daemon-reload (system) or systemctl --user daemon-reload (rootless). The systemctl manual documents daemon-reload as reloading unit files and, for generators, re-running them. 5. Start it: sudo systemctl start myapp.service (or systemctl --user start myapp.service). Do not run systemctl enable: generated units cannot be enabled. Boot-time start comes from the [Install] section, which the generator applies itself at each run. The container is named systemd-myapp unless ContainerName= is set. 6. AutoUpdate=registry labels the container for podman auto-update, which pulls a newer image and restarts the unit. It only runs when invoked or when podman-auto-update.timer is enabled (sudo systemctl enable --now podman-auto-update.timer, or --user); preview with podman auto-update --dry-run. The image must be a fully qualified reference. Check the label with podman inspect --format '{{ index .Config.Labels "io.containers.autoupdate" }}' systemd-myapp.

Expected result

systemctl status myapp.service --no-pager shows the generated unit active; stopping and starting it stops/starts the container via normal systemd dependency ordering, restart policies and logging (journalctl -u myapp.service). To undo, stop the service, delete the .container file and run daemon-reload again.

Limits and test basis

Quadlet file syntax and available keys are generator-specific and versioned with the Podman release; check the local man podman-systemd.unit for the installed version's supported keys before relying on one not shown here. A syntax error or unsupported key makes the generator skip the file, so systemctl later reports Unit myapp.service not found. Show the generated output and errors with /usr/lib/systemd/system-generators/podman-system-generator --dryrun (add --user for rootless units).