Podman Integration Guide

Overview

Podman provides daemonless container execution. Cup’n’String features native integration with Podman, resolving Podman’s own local and remote connection settings and querying Libpod for running containers and pods.

Support level

Native Integration

What Cup’n’String detects

• Active rootless, rootful, Podman Machine, SSH, and TCP Podman service endpoints
• CONTAINER_HOST, CONTAINER_CONNECTION, CONTAINER_SSHKEY, containers.conf, and managed Podman system connections
• Running Podman containers and pod inventory
• Exposed container ports and network interfaces

What it governs

• Local-network firewall rules for Podman networks
• Outbound secure relay session limits
• Attribution of socket traffic to active container IDs

Recommended policies

• Scan for unmanaged rootless container engines that bypass default Docker daemon audits
• Map Podman services to formal tenant-managed endpoints
• Enable drift protection on user namespaces

Setup outline

1. Start the Podman socket helper (podman system service) or configure a Podman system connection.
2. Enable the podman runtime in Local Services.
3. The Cup’n’String agent automatically resolves local sockets, Podman Machine connections, and Podman’s configured remote URL settings.
4. Container and pod state is read-only queried via the Podman Libpod API.

Verification

Verify running Podman containers appear in the Tenant Admin console under local runtimes.

Troubleshooting

Ensure the Podman system service socket or selected Podman system connection is active and readable by the current user.

Known limitations

Does not support container-internal prompt shielding without custom wrapper binaries.