Pre-release

Features

• A new command has been added, podman volume rename, to allow renaming volumes. Volumes created using volume drivers and volumes that are currently used by a container cannot be renamed (#28189).
• A new command has been added, podman machine restart, to allow easy restart of VMs managed by podman machine (#28366).
• The podman network rm command now includes a new option, --ignore, which suppresses errors when attempting to remove networks that do not exist (#28363).
• The podman manifest push command now includes two new options, --retry and --retry-delay, which allow pushes to be automatically retried on failure (#28590).
• Quadlet .container units now support a new key, ImageVolume=, to configure how volumes from images are handled (#28875).
• The podman generate kube command now includes support for generating container healthchecks as a livenessProbe (#22095).

Changes

• The podman info command now includes free memory available on the host (in addition to used memory and total memory) (#29116).
• The Pesto rootless port forwarding tool now supports IPv6 port forwarding with source IP preservation.

Bugfixes

• Fixed a bug where the remote Podman client could hang on some operations when connecting to a remote Podman service over SSH (#28453).
• Fixed a bug where the podman image scp command could not be used with usernames containing an @ character (#27655).
• Fixed a bug where the podman kube play command did not properly validate requested hostPort bindings, allowing the creation of containers with duplicated host ports which would never be able to start at the same time (#26622).
• Fixed a bug where podman machine VMs on Windows created using the hyperv provider would sometimes not properly start due to a race conditioning setting up volume mounts.
• Fixed a bug where podman machine VMs on Mac where machines could be left in an inconsistent state if the podman machine start command was interrupted by a signal.
• Fixed a bug where creating a container on a podman machine VM on Mac that attempted to bind to a port number number 1024 would return a nonsensical error message; a clear error explaining that privileged ports cannot be bound is now returned.
• Fixed a bug where the podman quadlet list and podman quadlet rm commands did not function properly with uninstantiated template Quadlets.
• Fixed a bug where the podman quadlet install command would occasionally fail to install a Quadlet if non-quadlet files were specified.
• Fixed a bug where the podman quadlet install command would not refuse to install Quadlets including non-quadlet files if the --application option was not specified.
• Fixed a bug where healthcheck logs could be corrupted, preventing proper healthcheck operation, if a healthcheck was killed midway through writing the file.
• Fixed a bug where the podman volume prune --all command incorrectly discarded label filters, causing podman volume prune --all --filter label=foo to prune all volumes, not just those with the foo label.
• Fixed a bug where the podman events --format=json command would print null instead of an error when the server sent an event that could not be decoded.
• Fixed a bug where a race condition could cause Quadlet to generate corrupt systemd units (#29004).
• Fixed a bug where the podman inspect command on a container with a single-element command (e.g. podman run fedora bash) would include the command in both Path and Args, when it should only have been included in Path (#29155).
• Fixed a bug where the --format option to podman inspect on containers did not properly support some format specifiers supported by Docker (e.g. {{.HostIp}} did not work, but {{.HostIP}} did) (#29164).
• Fixed a bug where the Quadlet generator would not write error messages to STDERR but only to /dev/kmsg, meaning that errors were not visible from systemd-analyze --generators verify and other tooling invoking the systemd generator directly.
• Fixed a bug where containers which failed to start would, in some circumstances, not properly clean up, resulting in improper behavior (#26143).
• Fixed a bug where the podman kube generate command would improperly generate warning messages only applicable when running as a rootless user on an SELinux enabled system when not running in that configuration (#17743).

API

• Fixed a bug where the Compat and Libpod Create endpoint for Exec Sessions (/containers/$CID/exec) did not honor the ConsoleSize parameter in the exec config.
• The Compat API has seen further changes to improve support for the Docker v1.44 API, including the deprecation of several fields removed in that release.
• Preparations have begun to implement support for the v1.45 API.

Misc

• Updated Buildah to v1.45.0
• Updated the image library to v5.41.0
• Updated the storage library to v1.64.0
• Updated the common library to v0.69.0

Security

• This release addresses CVE-2026-57231, where a malicious image using malformed Env entries could cause host environment variables to leak into containers run based on the image, including the ability to use the * glob operator to leak large numbers of environment variables without knowing their exact names (GHSA-4hq8-gpf5-8p68).
• This release addresses CVE-2026-19730 where the podman quadlet install --replace command did not truncate the file being replaced, meaning replacing a longer file with a shorter one would result in content from the original file incorrectly being retained.

Breaking Changes

• Due to breaking changes in this release, Podman v6.0.0 must be used with Buildah v1.44.0, Skopeo v1.23, Netavark and Aardvark v2.0.0, and configuration files from the container-libs repository's common/v0.68.0 release.
• Support for BoltDB databases has been dropped. Starting Podman 6 when the BoltDB database is in use will have Podman attempt an automatic migration from BoltDB to SQLite.
• Support for running on Intel Macs has been removed.
• Support for running on Windows 10 has been removed.
• Support for running on cgroups v1 systems has been removed. Please update your system to use cgroups v2.
• Support for running on iptables has been removed. Please use nftables instead.
• Support for CNI networking has been removed. Please use Netavark instead.
• Support for the slirp4netns rootless network stack has been removed. Please use Pasta instead. As part of this, the --network-cmd-path global option, only used with slirp4netns, has been removed.
• Podman's configuration file parsing logic has seen a major rewrite. Please see this document for exact details.
• Podman's import path has changed from github.com/containers/podman/v5 to go.podman.io/podman/v6 as part of our move into a CNCF-owned GitHub organization.
• Network isolation now defaults to enabled, improving Docker compatibility and security. A special workaround for the Docker-compatible API related to isolation being disabled has been removed (#27349).
• The way the podman quadlet suite of commands functions has been changed. Previously, Quadlets and their associated files were tracked using a .app file, ensuring that removing a Quadlet also removed all associated non-Quadlet files. Now, Quadlets and associated files are placed in subdirectories, which should reduce bugs and make manual management of Quadlets added by podman quadlet install much easier.
• VMs made by podman machine on Linux now mount volumes from the host using systemd. Volume mounts on existing podman machine VMs on Linux have been broken by this change, and the VM will need to be recreated.
• The podman volume prune command now matches Docker's behavior by only pruning unused anonymous volumes. Please use the newly-added --all option for the previous behavior (pruning all volumes).
• The podman volume list command now combines multiple filters using logical AND instead of logical OR (meaning all filters must match for a container to be included in output) (#26786).
• The label!= filter used in many commands now combines the output of multiple instances of the filter with logical AND instead of logical OR.
• The --format='{{json .Labels}} option to the podman ps, podman pod ps, and podman volume ls commands now prints its output as comma-separated key=value pairs instead of as a JSON map, improving Docker compatibility (#21847).
• The --all-providers option to podman machine list has been removed, as machines from all providers can now be accessed by all commands.
• The MemorySwappiness field of podman inspect is now set to nil when not explicitly set by the user (instead of -1), improving Docker compatibility (#23824).
• The podman commit command now pauses the container while committing changes, improving security by restricting concurrent modification. The prior behavior can be restored by using podman commit --pause=false ....
• The Go bindings for the REST API have removed the redundant nameOrID parameter from the artifacts.Remove() function.
• The minimum Go version required to build Podman is now v1.25.

Features

• All podman machine commands can now operate on VMs from all providers, regardless of what the current provider is set to. The provider set in the configuration only determines the provider used by newly-created VMs, and can be overridden by the new podman machine init --provider option. This should make operation of Mac and Windows installs mixing use of applehv and libkrun VMs, or hyperv and wsl VMs, much easier.
• A new command has been added, podman machine os update, which updates the operating system of a podman machine VM. Please note that this is not supported with the wsl provider.
• A new command has been added, podman system hyperv-prep, allowing Windows administrators to prepare a host for their users to run podman machine VMs using the hyperv provider.
• When starting a VM with podman machine start and podman machine init --now, if the connection to that VM is not the default, users will be prompted whether they want to change the default to the machine that was just started. This can also be controlled by a new option, --update-connection, which controls whether the default will be updated. If the --update-connection option is set, a user-interactive prompt is not displayed.
• The podman machine init and podman machine set commands now support a new option, --import-native-ca, which, when set, causes podman machine VMs on Windows, Linux, and Mac to import the host's trusted CA certificates each time the VM boots.
• The podman exec command now has a new option, --no-session, disabling API session tracking and database operations to increase performance (#26727).
• The podman image list --format json command now includes two new fields for each image, Repository and Tag (#27632).
• The manpages for Quadlets have been split into multiple files, one for each type of Quadlet file, and should be much more readable.
• Quadlet .volume units now support three new keys, UID= and GID= (to set the UID and GID that the volume will be created with) and Options= (to set generic volume options).
• Quadlet .container units now support mounting anonymous volumes (using a Mount= key with no source specified) (#28497).
• Two new search paths for Quadlets have been added, /usr/share/containers/systemd/users and /usr/share/containers/systemd/users/${UID}, to allow distributions to more easily package and distribute Quadlets (#27843).
• The podman quadlet list command now has a new alias, podman quadlet ls.
• The podman quadlet list command now has a new option, --noheading, which disables printing the table header. This is set automatically if the --format option is used.
• The pomdan quadlet list command now includes a new field in its output, Pod, which prints the pod a Quadlet .container unit is part of.
• The podman quadlet list command's --filter option now supports a new filter, status= (#28369).
• The --gpus option to podman create and podman run is now compatible with AMD GPUs.
• The podman create, podman run, and podman pod create commands can now specify volumes with a new option, nocreate (e.g. podman run --mount type=volume,src=myvol,dst=/mnt,nocreate) which will error if the specified volume does not exist, instead of creating it.
• The --log-opt option to the podman run and podman create now supports a new option, label=, to attach additional labels to logged messages (only usable with the journald log driver).
• Many Podman commands now expose a --tls-details option, allowing custom tuning of TLS settings using a containers-tls-details.yaml(5) file.
• The died event for Containers now exposes a new attribute, OOMKilled, which (if set) indicates the container was stopped due to running out of memory (#26701).
• Containers can now set multiple static IP addresses by passing the ip= option to --net multiple times (e.g. --net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4).
• The podman volume prune command now includes a new option, --all, to prune all unused volumes, not just anonymous volumes (#24597).
• The podman volume prune command now includes a new option, --dry-run, which returns the volumes that would be removed but does not actually remove them (#27838).
• The podman image scp command now includes a new option, --format, to set the archive format used for the image transfer (#28183).
• A new field has been added to containers.conf, default_host_ips, to set the default host IP that ports are forwarded from if an IP is not specified by the user ([#27186](https:...

Pre-release

Breaking Changes

• Due to breaking changes in this release, Podman v6.0.0 must be used with Buildah v1.44.0, Skopeo v1.23, Netavark and Aardvark v2.0.0, and configuration files from the container-libs repository's common/v0.68.0 release.
• Support for BoltDB databases has been dropped. Starting Podman 6 when the BoltDB database is in use will have Podman attempt an automatic migration from SQLite to BoltDB.
• Support for running on Intel Macs has been removed.
• Support for running on Windows 10 has been removed.
• Support for running on cgroups v1 systems has been removed. Please update your system to use cgroups v2.
• Support for running on iptables has been removed. Please use nftables instead.
• Support for CNI networking has been removed. Please use Netavark instead.
• Support for the slirp4netns rootless network stack has been removed. Please use Pasta instead. As part of this, the --network-cmd-path global option, only used with slirp4netns, has been removed.
• Podman's configuration file parsing logic has seen a major rewrite. Please see this document for exact details.
• Podman's import path has changed from github.com/containers/podman/v5 to go.podman.io/podman/v6 as part of our move into a CNCF-owned GitHub organization.
• Network isolation now defaults to enabled, improving Docker compatibility and security. A special workaround for the Docker-compatible API related to isolation being disabled has been removed (#27349).
• The way the podman quadlet suite of commands functions has been changed. Previously, Quadlets and their associated files were tracked using a .app file, ensuring that removing a Quadlet also removed all associated non-Quadlet files. Now, Quadlets and associated files are placed in subdirectories, which should reduce bugs and make manual management of Quadlets added by podman quadlet install much easier.
• VMs made by podman machine on Linux now mount volumes from the host using systemd. Volume mounts on existing podman machine VMs on Linux have been broken by this change, and the VM will need to be recreated.
• The podman volume prune command now matches Docker's behavior by only pruning unused anonymous volumes. Please use the newly-added --all option for the previous behavior (pruning all volumes).
• The podman volume list command now combines multiple filters using logical AND instead of logical OR (meaning all filters must match for a container to be included in output) (#26786).
• The label!= filter used in many commands now combines the output of multiple instances of the filter with logical AND instead of logical OR.
• The --format='{{json .Labels}} option to the podman ps, podman pod ps, and podman volume ls commands now prints its output as comma-separated key=value pairs instead of as a JSON map, improving Docker compatibility (#21847).
• The --all-providers option to podman machine list has been removed, as machines from all providers can now be accessed by all commands.
• The MemorySwappiness field of podman inspect is now set to nil when not explicitly set by the user (instead of -1), improving Docker compatibility (#23824).
• The podman commit command now pauses the container while committing changes, improving security by restricting concurrent modification. The prior behavior can be restored by using podman commit --pause=false ....
• The Go bindings for the REST API have removed the redundant nameOrID parameter from the artifacts.Remove() function.
• The minimum Go version required to build Podman is now v1.25.

Features

• All podman machine commands can now operate on VMs from all providers, regardless of what the current provider is set to. The provider set in the configuration only determines the provider used by newly-created VMs, and can be overridden by the new podman machine init --provider option. This should make operation of Mac and Windows installs mixing use of applehv and libkrun VMs, or hyperv and wsl VMs, much easier.
• A new command has been added, podman machine os update, which updates the operating system of a podman machine VM. Please note that this is not supported with the wsl provider.
• A new command has been added, podman system hyperv-prep, allowing Windows administrators to prepare a host for their users to run podman machine VMs using the hyperv provider.
• When starting a VM with podman machine start and podman machine init --now, if the connection to that VM is not the default, users will be prompted whether they want to change the default to the machine that was just started. This can also be controlled by a new option, --update-connection, which controls whether the default will be updated. If the --update-connection option is set, a user-interactive prompt is not displayed.
• The podman machine init and podman machine set commands now support a new option, --import-native-ca, which, when set, causes podman machine VMs on Windows, Linux, and Mac to import the host's trusted CA certificates each time the VM boots.
• The podman exec command now has a new option, --no-session, disabling API session tracking and database operations to increase performance (#26727).
• The podman image list --format json command now includes two new fields for each image, Repository and Tag (#27632).
• The manpages for Quadlets have been split into multiple files, one for each type of Quadlet file, and should be much more readable.
• Quadlet .volume units now support three new keys, UID= and GID= (to set the UID and GID that the volume will be created with) and Options= (to set generic volume options).
• Quadlet .container units now support mounting anonymous volumes (using a Mount= key with no source specified) (#28497).
• Two new search paths for Quadlets have been added, /usr/share/containers/systemd/users and /usr/share/containers/systemd/users/${UID}, to allow distributions to more easily package and distribute Quadlets (#27843).
• The podman quadlet list command now has a new alias, podman quadlet ls.
• The podman quadlet list command now has a new option, --noheading, which disables printing the table header. This is set automatically if the --format option is used.
• The pomdan quadlet list command now includes a new field in its output, Pod, which prints the pod a Quadlet .container unit is part of.
• The podman quadlet list command's --filter option now supports a new filter, status= (#28369).
• The --gpus option to podman create and podman run is now compatible with AMD GPUs.
• The podman create, podman run, and podman pod create commands can now specify volumes with a new option, nocreate (e.g. podman run --mount type=volume,src=myvol,dst=/mnt,nocreate) which will error if the specified volume does not exist, instead of creating it.
• The --log-opt option to the podman run and podman create now supports a new option, label=, to attach additional labels to logged messages (only usable with the journald log driver).
• Many Podman commands now expose a --tls-details option, allowing custom tuning of TLS settings using a containers-tls-details.yaml(5) file.
• The died event for Containers now exposes a new attribute, OOMKilled, which (if set) indicates the container was stopped due to running out of memory (#26701).
• Containers can now set multiple static IP addresses by passing the ip= option to --net multiple times (e.g. --net mynet:ip=10.0.0.2,ip=10.0.0.3,ip=10.0.0.4).
• The podman volume prune command now includes a new option, --all, to prune all unused volumes, not just anonymous volumes (#24597).
• The podman volume prune command now includes a new option, --dry-run, which returns the volumes that would be removed but does not actually remove them (#27838).
• The podman image scp command now includes a new option, --format, to set the archive format used for the image transfer (#28183).
• A new field has been added to containers.conf, default_host_ips, to set the default host IP that ports are forwarded from if an IP is not specified by the user (#27186).
• The podman image trust suite of commands now support a new --signature-policy option, which is mandatory for podman image trust set.
• Events now include artifact lifecycle events (create, pull, push, and remove) (#27260).
• A new experimental option for the rootless_port_forwarder field in containers.conf has been added, rootless_port_forwarder="pasta". When set, rootless bridge networks will use Pasta's kernel-level port forwarding via Pesto instead of rootlessport, preserving the original client source IP in network traffic in rootless containers. The default remains rootlessport (the default for Podman 5.x), but we will investigate switching at a later date when stability is more certain.
• A new fil...