What Is New in Podman 4.4
Podman 4.4 delivers a host of improvements focused on networking, the REST API, container lifecycle management, and support for new platforms. This release continues to enhance the developer experience with more robust tools and better integration.
| Category | Key Updates |
|---|---|
| New Features | New container checkpoint/restore flags, HTTP API improvements, new `podman unshare` command. |
| Networking | DNS improvements for rootless containers, new `--dns-opt` flag, MACVLAN driver updates. |
| Improvements & Changes | Enhanced `podman machine` for macOS, new log driver, SELinux and secret management updates. |
| Bug Fixes | Resolved issues with image handling, volume permissions, and container state management. |
What networking improvements were made?
Rootless containers finally get reliable DNS resolution. The new `--dns-opt` flag allows you to pass custom options directly to the container's resolv.conf, which is huge for debugging and tuning name lookups.
For advanced networking setups, the MACVLAN driver now lets you specify a MAC address with `--mac-address` and automatically tears down networks when the last container using them is removed. This cleans up resources you didn't even know were still hanging around.
How has the Podman API evolved?
The HTTP API is now more powerful and consistent. You can filter images by digest using `?digest=` and properly handle large image pulls without timeouts. The `/_ping` endpoint also includes the API version, making it easier for clients to perform compatibility checks upfront.
In practice, this means your automation scripts and tools can be more robust. The libpod endpoints now support the same filters as the CLI, closing a long-standing gap between the command-line and API experiences.
What's new for container checkpoint and restore?
The `podman container checkpoint` and `restore` commands gained new flags for finer control. You can now use `--ignore-rootfs` to exclude the container's root file system from the checkpoint, which is useful for iterative debugging of application state.
For production use cases, `--pre-checkpoint` allows you to create a series of incremental checkpoints. This significantly reduces downtime during a final restore because the container doesn't have to start from a full, potentially large, snapshot.
What updates affect the Podman machine experience?
On macOS, `podman machine` now uses the gvproxy network stack by default. This change simplifies the setup and provides a more stable networking foundation for your containers compared to the previous VPNKit implementation.
The `podman machine stop` command also became more forceful. It now uses `poweroff` instead of `shutdown`, which is a more reliable way to ensure the VM actually stops when you tell it to, preventing ghost VMs from consuming resources.
Are there new commands or changes to existing ones?
A new `podman unshare` command gives you a shell inside the user namespace that Podman uses for rootless operations. This is a game-changer for debugging permission issues with volumes and files created by rootless containers.
Logging gets an upgrade with a new `--log-driver=passthrough` option. This driver sends logs directly to the container's standard output and error streams without any intermediate processing, which is much cleaner for systemd-based setups.
FAQ
How do I use the new --dns-opt flag?
Use it just like the standard `dns-option` in
`resolv.conf`. For example, to set a timeout:
podman run --dns-opt timeout:3 alpine nslookup example.com. This is especially useful for tuning
DNS behavior in rootless environments.
What does the new 'podman unshare' command actually do?
It drops you into a shell with the
same user namespace mappings as your rootless containers. This lets you inspect and modify files in volumes that
were created by a container, which previously had confusing ownership permissions from the host's perspective.
Why would I use --ignore-rootfs during checkpointing?
This flag is for when you only care
about the in-memory state of the application (e.g., a database's cache). It makes the checkpoint process faster
and the resulting file much smaller, as it doesn't include the container's entire root filesystem.
Is the switch to gvproxy on macOS a breaking change?
For new machines, it's the default and
is transparent. Existing machines continue to use their previously configured network stack. You might see
improved stability and performance on new setups.
How does the new passthrough log driver work with systemd?
It bypasses Podman's internal
logging buffer and writes directly to stdout/stderr. This means systemd's journal can capture logs natively with
correct timestamps, making it the preferred choice for systems using journald.