What Is New in Podman 3.2
Podman 3.2 brings a host of new features, improvements, and bug fixes that enhance container management. This release focuses on expanding platform support, refining the user experience, and improving security. The key updates are summarized in the table below.
| Category | Key Changes |
|---|---|
| New Features | Native macOS client, Init support, New container exit policies |
| Platform Support | Apple Silicon (M1) support, Improved Windows WSL2 integration |
| Networking | Rootless container IP address assignment, New `podman network connect/disconnect` commands |
| Security | Support for `--pull` policy with `never` option, Enhanced secret handling |
| Improvements & Changes | Podman API v2, Improved `podman image tree`, Better volume support |
| Bug Fixes | Numerous fixes for pods, rootless operations, and container lifecycle |
What are the headline features in Podman 3.2?
The macOS client is a game-changer for developers on Apple hardware. It provides a native experience for managing containers on Macs without needing a VM for the CLI, though the containers themselves still run in a VM. This makes the development workflow much smoother.
Init support allows containers to run an init process as PID 1, which helps with signal handling and zombie
process reaping. You can use the --init flag with podman run or specify a custom init
path with --init-path.
The new container exit policies give you more control over what happens when a container's main process exits. You can now choose to stop the container, restart it, or keep it running, which is useful for debugging.
How does Podman 3.2 improve support for Apple hardware?
This release officially adds support for Apple's M1 silicon. For Intel-based Macs, the new native macOS client means you can run the Podman command-line tool directly on your machine instead of inside a VM.
The actual containers still execute inside a Linux VM, but the client experience is now seamless. This is a significant quality-of-life improvement for anyone developing on a Mac and using containers in their workflow.
What networking upgrades should I know about?
Rootless containers can now be assigned specific IP addresses, which is a big deal for complex networking setups
without root privileges. The new podman network connect and podman network disconnect
commands let you dynamically manage a container's network interfaces.
This means you can now connect a running container to an additional network without having to restart it. This adds a layer of flexibility that was previously missing, especially for debugging and service discovery scenarios.
Are there new security capabilities in this release?
The --pull policy now includes a never option, which instructs Podman to only use
images that are already present locally. This is crucial for air-gapped or security-conscious environments where
pulling from a remote registry is not allowed.
Enhancements to secret handling provide a more robust way to manage sensitive data. This works in tandem with the
existing podman secret commands to improve the security posture of container deployments.
What other improvements have been made?
The Podman API (v2) has seen continued development, making it more stable and feature-complete for those
automating container operations. The podman image tree command now displays more information,
making it easier to understand image layers and dependencies.
Volume management has been improved, and there are numerous under-the-hood bug fixes. These fixes address issues related to pod lifecycle, rootless container stability, and overall reliability, making Podman 3.2 a more polished release.
FAQ
How do I use the new native macOS client?
Install the Podman package for macOS. Once
installed, you can use the podman command directly from your terminal. Remember, the containers
still run in a Linux VM in the background, but the client interface is now native.
What does the new `--exit-policy` option do?
It controls the container's behavior after its
main process exits. The available policies are stopped (default), restart, and
continue. The continue policy is particularly useful for debugging as it keeps the
container running.
Can I now assign static IPs to rootless containers?
Yes. You can use the --ip
flag with podman run to assign a specific IP address to a rootless container, provided you are
using a network that supports this functionality, like a bridge network you created.
What is the purpose of the `--pull=never` policy?
It prevents Podman from attempting to pull
an image from any registry. If the specified image is not found locally, the command will fail. This is a
security and compliance feature for environments that must avoid external network calls for images.
How do the new `podman network connect` commands work?
They allow you to connect a running
container to a new network or disconnect it from one without a restart. For example,
podman network connect mynet mycontainer adds the container to the "mynet" network on the fly.