> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/podman.md).

# Podman

[Podman](https://podman.io/) is a daemonless container engine for developing, managing, and running [OCI Containers](https://opencontainers.org/) on the Linux System. Containers can either be run as root or in rootless mode.

If you use the Shell installer to install an engine, Cortex Xpanse automatically detects the container management type based on the operating system. For example, if your operating system is running RHEL v8 and higher, Cortex Xpanse installs Podman packages and configures the operating system to enable Podman in rootless mode.

{% hint style="info" %}

### Note

When upgrading an engine, the engine keeps the previously used container management type (regardless of distribution version).
{% endhint %}

By default, Podman uses the **`$HOME/.local/share/containers/storage`** directory. To use a different directory for container storage, edit the [Podman config file](https://github.com/containers/podman/blob/main/vendor/github.com/containers/storage/storage.conf#L33) located at **`/home/demisto/.config/containers/storage.conf`**. If the file does not exist, create it and change the ownership:

* **`cp /etc/containers/storage.conf /home/demisto/.config/containers`**
* **`chown demisto:demisto /home/demisto/.config/containers/storage.conf`**

To set a different directory for container storage, change the key: **`rootless_storage_path`** in the **`storage.conf`** file. For example, **`rootless_storage_path=/var/lib/containers/$USER/storage`**

The new storage directory needs to be owned by the **demisto** user, otherwise they will be denied access to it. To assign the **demisto** user ownership of the new storage directory, on the Linux command line, run **`chown -R demisto:demisto <NEW-LOCATION>`**.

Do not use [NAS storage](https://en.wikipedia.org/wiki/Network-attached_storage) for the $HOME directory. The directory needs to be a local directory for Podman to work.

{% hint style="info" %}

### Tip

We recommend reserving 150 GB for container storage, either in the /home partition or a different storage directory that you have set using the **`rootless_storage_path`** key.
{% endhint %}

If using PowerShell integrations, you may need to configure the default SELinux policy as Podman can affect processes which **`mmap`** to **`/dev/zero`**.

**Docker Hardening Guidelines**

Docker hardening guidelines can be applied to Podman, with the exception of Limit Available Memory, Limit Available CPU, and Limit PIDS.

**Install Podman**

This procedure for engines running on RHEL 8 or later. It may not work for other OS types.

{% hint style="info" %}

### Note

Do not use [NAS storage](https://en.wikipedia.org/wiki/Network-attached_storage) for the $HOME directory. The directory needs to be a local directory for Podman to work.
{% endhint %}

1. Install Podman with related packages by typing the following commands:
   * **`sudo yum -y install slirp4netns fuse-overlayfs`**
   * **`sudo yum -y module install container-tools`**
2. Run the following commands:
   * **`sudo touch /etc/subuid /etc/subgid`**
   * **`sudo mkdir -p /home/demisto`**
   * **`sudo chown demisto:demisto /home/demisto`**
3. Configure the **`unqualified-search-registries`** used by Podman.

   Podman by default uses the fedoraproject.org, redhat.com, centos.org, and docker.io unqualified search registries. Since Cortex Xpanse images use only the docker.io registry, you can speed up download times for container images by setting **`unqualified-search-registries`** to just docker.io.

   1. Create or edit the **`/home/demisto/.config/containers/registries.conf`** config file.
   2. In the file, set **`unqualified-search-registries = ["docker.io"]`**.

      <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you edit the file with the <strong><code>root</code></strong> user, make sure to set the <strong><code>demisto</code></strong> user as file owner by running <strong><code>chown demisto:demisto /home/demisto/.config/containers/registries.conf</code></strong></p></div>
4. Change the **`subuids`** and **`subgids`** by running the following command:

   **`sudo usermod --add-subuids 200000-265535 --add-subgids 200000-265535 demisto`**
5. Set the **`net.ipv4.ping-group-range`**, by typing the following commands:
   * **`sudo sh -c "echo 'net.ipv4.ping_group_range=0 2000000' > /etc/sysctl.d/demisto-ping.conf"`**
   * **`sudo sysctl -w "net.ipv4.ping_group_range=0 2000000"`**
6. As root user, edit the following **`config`** file:

   **`/usr/local/demisto/d1.conf`**
7. Change the \*\*`"container.engine.type": "docker"`\*\*to **`“podman`**”.

   If this line does not exist, add the following line to the file:

   **`"container.engine.type": "podman"`**

   ```programlisting
   "Server": {
                   "HttpsPort": "443",
                   "ProxyMode": true
           },
           "container": {
                                   "engine": {
                                           "type": "podman"
                                   }
           },
           "db": {
                   "index": {
                           "entry": {
                                   "disable": true
   ```

**Troubleshoot Podman Installation**

<details>

<summary>Keyring Quota Exceeded Error</summary>

`Script failed to run: Docker code runner got container error: [Docker code script is in inconsistent state, ... error: [exit status 126] stderr: [Error: OCI runtime error: crun: create keyring ...: Disk quota exceeded]`

By default, Podman creates a `keyring` that is used by each container. The limit per user on the machine might be low and Podman can reach the limit when running more containers than the `keyring` limit. To check the `keyring` usage, run the **`sudo cat /proc/key-users`** operating system command.

The command returns the usage for each UID (to retrieve the demisto user UID, run **`id demisto`** ). The fourth column shows the number of keys used out of the total number available. For more information about keys, see [Kernel Key Retention Service](https://www.kernel.org/doc/Documentation/security/keys.txt).

You can either increase the limit of max keyrings (increasing to 1000 is safe and reasonable) per user as specified by your Linux vendor documentation or you can disable keyring creation by Podman. We recommend disabling keyring creation, unless keyrings are used by Podman in other applications on the machine. To disable keyring creation by Podman, modify the `containers.conf` file and add the option `keyring = false` under the `"[containers]"` section. For more information, see the [Containers Engine Configuration File](https://github.com/containers/common/blob/main/docs/containers.conf.5.md).

</details>

<details>

<summary>Unused Containers Taking up Resources</summary>

In some cases, if the Podman process crashes or is killed abruptly it can leave containers on disk. You might see errors such as `error allocating lock for new container: allocation failed; exceeded num_lock` when the maximum number of locks used to manage containers is exhausted due to the unused containers that remain.

1. Change to the demisto operating system user `sudo su - -s /bin/bash demisto`.
2. Run `podman ps -a -f status=exited` to check for unused containers.
3. Clean up the unused containers `podman container cleanup --rm -a`.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>When you run <code>podman container cleanup --rm -a</code>, you might see a message such as <code>running or paused containers cannot be moved without force</code>. The message can be safely ignored, as it only pertains to current running containers, which are not removed.</p></div>
4. After clean up, verify there are no remaining unused containers `podman ps -a -f status=exited`.

</details>

**Migrate From Docker to Podman**

Although Podman is set up automatically in an engine installation, it is possible to migrate from Docker to Podman in an existing engine.

{% hint style="info" %}

### Note

* This procedure is intended for RHEL 8 or later. It may not work for other operating system types.
* Do not use [NAS storage](https://en.wikipedia.org/wiki/Network-attached_storage) for the $HOME directory. The directory needs to be a local directory for Podman to work.
  {% endhint %}

1. Install Podman with related packages by typing the following commands:
   * `sudo yum -y install slirp4netns fuse-overlayfs`
   * `sudo yum -y module install container-tools`
2. Run the following commands:
   * `sudo touch /etc/subuid /etc/subgid`
   * `sudo mkdir -p /home/demisto`
   * `sudo chown demisto:demisto /home/demisto`
3. Configure the `unqualified-search-registries` used by Podman.

   Podman by default uses the fedoraproject.org, redhat.com, centos.org, and docker.io unqualified search registries. Since Cortex XSOAR images use only the `docker.io` registry, you can speed up download times for container images by setting `unqualified-search-registries` to just `docker.io`.

   1. Create or edit the `/home/demisto/.config/containers/registries.conf` file.
   2. In the file, set `unqualified-search-registries = ["docker.io"]`.

   <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>If you edit the file with the <strong><code>root</code></strong> user, make sure to set the <strong><code>demisto</code></strong> user as file owner by running <code>chown demisto:demisto /home/demisto/.config/containers/registries.conf</code>.</p></div>
4. Change the `subuids` and `subgids`:

   `sudo usermod --add-subuids 200000-265535 --add-subgids 200000-265535 demisto`
5. Migrate existing containers to Podman:

   `sudo sh -c "podman system migrate"`
6. Set the `net.ipv4.ping-group-range`, by typing the following commands:
   * `sudo sh -c "echo 'net.ipv4.ping_group_range=0 2000000' > /etc/sysctl.d/demisto-ping.conf"`
   * `sudo sysctl -w "net.ipv4.ping_group_range=0 2000000"`
7. As root user, edit the `/usr/local/demisto/d1.conf` file
8. Change the `"container.engine.type": "docker"` to `"podman"`.

   If this line does not exist, add the following line to the file:

   **`"container.engine.type": "podman"`**

   ```programlisting
    "Server": {
                   "HttpsPort": "443",
                   "ProxyMode": true
           },
           "container": {
                                   "engine": {
                                           "type": "podman"
                                   }
           },
           "db": {
                   "index": {
                           "entry": {
                                   "disable": true
   ```
9. Restart the service:

   `sudo systemctl restart d1`


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xpanse/active-response/engines/podman.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.