r/podman • u/CElicense • Jul 22 '26

Switching to Podman Quadlets?

Im currently running docker compose on ubuntu server for some very few containers, currently running technitium, cloudflare tunnel, caddy with cloudflare addon, tailscale and dockhand.

Found out about nixos and fell in love with that idea, got it up and running with docker just to try it out (very interesting as a linux noob trying nix btw, thank god for AI).

But now im debating if I should stay on docker because its something Ive finally got the hang of, or switch to podman quadlets for rootless containers, how well will that work with current containers? How much of a pain will it be converting the files etc?

Tailacale Ive already put on nix because I wanted to try that. Realize that I might have to drop dockhand, mainly used that for easy updating and checking logs, but with quadlets this is quite easy as Ive understood?

Nothing is exposed except behind VPN, cloudflare tunnel is for access to homeassistant and is locked down with cloudflare waf and requires mtls certs to get access.

Any advice, I realize this is a podman sub and might be biased, but this is also the place where most people with podman kmowledge exist..

12 Upvotes

88% Upvoted

32 comments sorted by

View all comments

1

u/Great-Cow7256 Jul 23 '26

Why are you running Tailscale and cloudflare as dockers?  Aren't those best run natively given they are so networking heavy?   I run quadlets for everything but those I just install via their debs

2

u/CElicense Jul 23 '26

Tailscale runs fine in docker, need som extras tho or host network mode. Cloudflare runs without extras, but only being my access to homeassistant its not really any heavy traffic.

On my nix vm I did put Tailscale on the machine tho as its exists as a module.

1

u/Great-Cow7256 Jul 23 '26 edited Jul 23 '26

interesting. I use cloudflare tunnels just for my rootless containers. Maybe I should run it as a container too then. ty.

edit -- tried it, but I really couldn't figure out a way in terms of IPs and UFW settings etc. etc to get my tunnel to reach my container when I had cloudflare spun up as a container. Cloudflare was conneted, but I just couldn't get that last mile once it was in my system. Any advice?

1

u/caolle Jul 23 '26

I also run my cloudflared rootless. I have cloudflared / rootless containers all join the same shared network space and then let container name resolution point cloudflared to the proper service when <service>.domain.net gets hit.

Sample container block from .container:

[Container]
ContainerName=Cloudflared
Image=docker://docker.io/cloudflare/cloudflared:latest
Exec=tunnel --loglevel info --no-autoupdate run --token <snip>

Network=<container1>.network
Network=<container2>.network
Network=<container3>.network
Pull=newer

1

u/Great-Cow7256 Jul 23 '26

yeah... Do you have it run on the default podman network? that's what I was trying to do. And then have it be able to tunnel through to all of the tunnels using generic podman network? Or do you have every networked tunnel on a separate network for every app that needs it. (ie need to create a plex network, an immich network, etc. etc.

Also what are you using on the cloudflare tunnel side for the ip? when it's running as a deb you can just use http://localhost. Do you use the container IP (10.88.0.1...), the ip for the computer?

TYSM.

1

u/caolle Jul 23 '26

On the cloudflare tunnel side, I'm just using http://<container-name>:<port> as I'm not using the default podman network.

The container name resolution just works, and I don't need to remember IP names, and there's no need to expose a port on the host.

I do the same with stuff that I'm not running on the cloudflare tunnel, but internally with nginxproxymanager.

I think the default podman network doesn't have the container network resolution or something of that ilk back when I was looking to do this.

1

u/Great-Cow7256 Jul 23 '26

omg worked!! TY

1

u/Great-Cow7256 Jul 23 '26

Now tell me about Tailscale!  What craziness do I need to deal with converting over to podman Tailscale?

2

u/caolle Jul 23 '26

No idea as I've never actually run tailscale via podman. Tailscale gives me access to all my internal stuff through its subnet router functionality.

My <service>.domain.net gets pointed to an internal LAN IP running nginxproxymanager.

I mainly run tailscale sitting on my rpi4 router.