Production-Ready Step-by-Step Guide Rootless Podman + Quadlet on Red Hat Enterprise Linux 10

This guide is designed for a production environment as assums a fresh install of Redhat. It uses the modern Quadlet method (recommended) and follows Red Hat best practices for RHEL 10.

---

1. System Requirements (Production)

Check cgroup version:

podman info --format '{{.Host.CgroupVersion}}'

Epel Release

subscription-manager repos --enable codeready-builder-for-rhel-10-$(arch)-rpms dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-10.noarch.rpm -y

After Epel installation rerun the upgrade to update if any are needed

dnf upgrade -y

dnf install bind-utils bzip2 cups cifs-utils enscript ftp gdb ghostscript krb5-workstation ksh lftp lrzsz lsof libnsl lzop plocate mutt ncompress net-tools net-snmp net-snmp-utils net-tools nfs-utils nmap nvme-cli openldap-clients openssh-clients psmisc realmd rsync samba-client strace sysstat tcpdump telnet telnet-server tmux unix2dos vim vim-enhanced vsftpd wget xfsdump vsftpd htop mc rsyslog rsyslog-doc postfix dbus-daemon s-nail dovecot cyrus-sasl cyrus-sasl-lib cyrus-sasl-plain tree figlet toilet coreutils -y

---

2. Prepare the System

2.1 Register and Update RHEL 10

sudo dnf update -y sudo reboot

2.2 Install Container Tools

sudo dnf install -y container-tools

Optional (Docker CLI compatibility):

sudo dnf install -y podman-docker

Verify:

podman --version podman info

---

3. Create a Dedicated Service User (Best Practice)

For production, avoid running services under a regular interactive user.

# Create a system user for containers sudo useradd -r -m -d /home/podman -s /bin/bash podman # Set a strong password or disable password login sudo passwd podman # or lock the account later

Grant subordinate UIDs/GIDs (required for rootless):

sudo usermod --add-subuids 100000-165535 --add-subgids 100000-165535 podman

---

4. Enable Lingering (Critical for Production)

This allows the user services to run even when the user is not logged in.

sudo loginctl enable-linger podman

Verify:

loginctl show-user podman | grep Linger # Linger=yes

---

5. Configure Rootless Environment

Switch to the service user:

sudo -u podman -i

Create required directories:

mkdir -p ~/.config/containers/systemd mkdir -p ~/.config/containers mkdir -p ~/.local/share/containers

Optional but Recommended: Storage Configuration

cat > ~/.config/containers/storage.conf << 'EOF' [storage] driver = "overlay" runroot = "/run/user/$(id -u)/containers" graphroot = "$HOME/.local/share/containers/storage" [storage.options.overlay] mount_program = "/usr/bin/fuse-overlayfs" mountopt = "nodev,fsync=0" EOF

Optional: Registries Configuration

cat > ~/.config/containers/registries.conf << 'EOF' unqualified-search-registries = ["registry.access.redhat.com", "registry.redhat.io", "docker.io", "quay.io"] [[registry]] location = "docker.io" insecure = false EOF

---

6. Create Your First Production Quadlet

A) Example: Nginx reverse proxy / web service

cat > ~/.config/containers/systemd/nginx.container << 'EOF' [Unit] Description=Nginx Web Server (Production) After=network-online.target Wants=network-online.target [Container] Image=docker.io/library/nginx:alpine ContainerName=nginx PublishPort=8080:80 Volume=nginx-data.volume:/usr/share/nginx/html:Z Volume=nginx-conf.volume:/etc/nginx/conf.d:Z AutoUpdate=registry Environment=TZ=America/New_York PodmanArgs=--memory=512m --cpus=1.0 --memory-swap=512m [Service] Restart=always TimeoutStartSec=300 [Install] WantedBy=default.target EOF

A) Create supporting volumes:

cat > ~/.config/containers/systemd/nginx-data.volume << 'EOF' [Volume] VolumeName=nginx-data EOF cat > ~/.config/containers/systemd/nginx-conf.volume << 'EOF' [Volume] VolumeName=nginx-conf EOF

cat > ~/.config/containers/systemd/myapp.container << 'EOF' [Unit] Description=My Application (Production) After=network-online.target Wants=network-online.target [Container] Image=your-registry/your-app:latest ContainerName=myapp PublishPort=8080:8080 Volume=myapp-data.volume:/data:Z AutoUpdate=registry Environment=TZ=America/New_York PodmanArgs=--memory=1g --cpus=1.5 --memory-swap=1g [Service] Restart=always TimeoutStartSec=300 [Install] WantedBy=default.target EOF

B) Create supporting volume:

cat > ~/.config/containers/systemd/myapp-data.volume << 'EOF' [Volume] VolumeName=myapp-data EOF

 

---

7. Activate the Service

A) Example for Nginx

# Reload systemd user units systemctl --user daemon-reload # Start and enable systemctl --user enable --now nginx.service # Check status systemctl --user status nginx.service podman ps

View logs:

journalctl --user -u nginx.service -f

systemctl --user daemon-reload systemctl --user enable --now myapp.service # Verify systemctl --user status myapp.service podman ps

View logs:

journalctl --user -u myapp.service -f

 

---

8. Configure pfSense HAProxy

In pfSense HAProxy:

1. Backend
   • Mode: http
   • Server: IP of your RHEL 10 host
   • Port: 8080 (or whatever you published)
   • Health check: recommended
2. Frontend
   • Bind to WAN / desired interface
   • TLS offloading (recommended)
   • ACL based on Host header (e.g. hdr(host) -i app.yourdomain.com)
   • Use backend created above
3. Firewall Rules
   • Allow traffic from HAProxy (or LAN) to the RHEL host on the published port(s) only.

Firewall example:

sudo firewall-cmd --permanent --add-port=8080/tcp sudo firewall-cmd --reload

 

---

9. Production Hardening Checklist

Enable auto-update timer (as podman user):

systemctl --user enable --now podman-auto-update.timer

---

9. Useful Management Commands

# List all user services systemctl --user list-units --type=service # Restart a service systemctl --user restart nginx.service # Stop a service systemctl --user stop nginx.service # View resource usage podman stats # Update all containers with AutoUpdate podman auto-update

# Service management systemctl --user status myapp.service systemctl --user restart myapp.service systemctl --user stop myapp.service # Container status & resources podman ps podman stats # Logs journalctl --user -u myapp.service -f # Manual update podman auto-update

 

---

10. Optional: Auto-Update Timer

Enable Podman’s auto-update timer (as the podman user):

systemctl --user enable --now podman-auto-update.timer

---

Summary of Key Directories (Rootless)

Summary

• HAProxy on pfSense = edge reverse proxy / TLS / routing
• RHEL 10 + rootless Podman + Quadlet = application runtime
• No Nginx needed unless the application itself requires it