How do I activate automatic image updates with generated Quadlet units?

Keep AutoUpdate=registry enabled in the generator, verify every Image= line uses a fully qualified registry domain, and enable the timer with systemctl --user enable --now podman-auto-update.timer.

How can I preview the compiled systemd service output before starting containers?

Copy the generated files into ~/.config/containers/systemd/ and run /usr/libexec/podman/quadlet -dryrun -user in your terminal to inspect the exact ExecStart podman run invocation and catch syntax issues.

Can rootless Podman bind Caddy to ports 80 and 443?

Rootless users cannot bind ports below 1024 by default on Linux. Either publish higher host ports such as 8080:80 and 8443:443, route traffic with firewalld, or lower net.ipv4.ip_unprivileged_port_start=80 via sysctl.

What replaces podman generate systemd in modern Podman releases?

Upstream Podman deprecated podman generate systemd in favor of Quadlet declarative unit files because Quadlet adapts container lifecycle flags across Podman upgrades without regenerating static shell wrappers.

Podman 4.4+ systemd unit preset Scope: rootless

Podman Quadlet Generator for Declarative systemd Services

Generate production-ready Podman Quadlet .container units with AutoUpdate=registry labels, systemd restart rules, and rootless or rootful install paths. Start from the Vaultwarden and Caddy preset or paste your own stack.

Compose -> Quadlet Cheat Sheet Technical Notes Preset FAQ Related Generators

1-Click Stack Quick-Load Zero server uploads. Runs locally in browser memory.

Sample Stack Template

Stack Name Prefix

Install Scope

SELinux Mounts

AutoUpdate=registry Generate shared .network Extract secrets to .env

Drop compose.yaml / .txt here or browse .yml .yaml .txt

Detected mode: compose-yaml | Generated units: 7 (2 services) | Target directory: ~/.config/containers/systemd/

2 .container units .network DNS: vaultwarden.network (aardvark-dns) 3 .volume units .env secrets: vaultwarden.env (chmod 600) Install path: ~/.config/containers/systemd/

Compose YAML or Docker / Podman Run Input Mode: compose-yaml

Generated Quadlet systemd Units

# === vaultwarden.container (~/.config/containers/systemd/vaultwarden.container) ===
[Unit]
Description=vaultwarden vaultwarden container
Wants=network-online.target
After=network-online.target
After=vaultwarden-network.service

[Container]
Image=docker.io/vaultwarden/server:latest
ContainerName=vaultwarden
AutoUpdate=registry
Network=vaultwarden.network
Volume=vw-data.volume:/data
EnvironmentFile=%h/.config/containers/systemd/vaultwarden.env
Environment=DOMAIN=https://vault.internal.lan
Environment=SIGNUPS_ALLOWED=false
Environment=WEBSOCKET_ENABLED=true
HealthCmd=/healthcheck.sh
HealthInterval=30s
HealthRetries=3

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=default.target

# === caddy.container (~/.config/containers/systemd/caddy.container) ===
[Unit]
Description=vaultwarden caddy container
Wants=network-online.target
After=network-online.target
After=vaultwarden-network.service
After=vaultwarden.service
Requires=vaultwarden.service

[Container]
Image=docker.io/library/caddy:2-alpine
ContainerName=caddy
AutoUpdate=registry
Network=vaultwarden.network
PublishPort=80:80
PublishPort=443:443
PublishPort=443:443/udp
Volume=./Caddyfile:/etc/caddy/Caddyfile:ro
Volume=caddy-data.volume:/data
Volume=caddy-config.volume:/config

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=default.target

# === vaultwarden.network (~/.config/containers/systemd/vaultwarden.network) ===
[Unit]
Description=vaultwarden shared Podman network

[Network]
NetworkName=vaultwarden

# === vw-data.volume (~/.config/containers/systemd/vw-data.volume) ===
[Unit]
Description=vw-data Podman volume

[Volume]
VolumeName=vw-data

# === caddy-data.volume (~/.config/containers/systemd/caddy-data.volume) ===
[Unit]
Description=caddy-data Podman volume

[Volume]
VolumeName=caddy-data

# === caddy-config.volume (~/.config/containers/systemd/caddy-config.volume) ===
[Unit]
Description=caddy-config Podman volume

[Volume]
VolumeName=caddy-config

# === vaultwarden.env (~/.config/containers/systemd/vaultwarden.env) ===
ADMIN_TOKEN=argon2-admin-secret-token

systemd Deployment & Reload Commands

mkdir -p ~/.config/containers/systemd
chmod 600 ~/.config/containers/systemd/vaultwarden.env
systemctl --user daemon-reload && systemctl --user start vaultwarden.service caddy.service
systemctl --user status vaultwarden.service caddy.service
loginctl enable-linger $USER

Technical notes for Quadlet Generator

01
Enabling AutoUpdate=registry adds io.containers.autoupdate=registry to generated units so podman-auto-update.timer pulls newer digests and restarts changed services.
02
AutoUpdate requires fully qualified registry image names such as docker.io/library/caddy:2-alpine or ghcr.io/dani-garcia/vaultwarden:latest rather than short aliases.
03
Compose restart policies such as unless-stopped and always map to [Service] Restart=always or Restart=on-failure under systemd supervision.
04
You can validate generated syntax on any Linux host before reloading systemd by running /usr/libexec/podman/quadlet --dryrun --user.

Syntax Mapping Reference

Compose Key -> Quadlet Directive Cheat Sheet

Quick lookup for how Compose YAML fields and docker or podman run flags translate into Podman systemd unit directives.

Compose Key / CLI Flag	Unit Section	Quadlet Directive	Linux systemd Behavior
services.<app>.image	[Container]	Image=docker.io/library/...	Use a fully qualified registry host when AutoUpdate=registry is enabled.
ports: ["8080:80"] / -p	[Container]	PublishPort=8080:80	Repeats once per published host port; supports bind IP and /udp protocol suffixes.
volumes: ["./data:/data"] / -v	[Container] + .volume	Volume=/srv/data:/data:Z	Named volumes map to <name>.volume units; bind mounts append :z or :Z on SELinux hosts.
environment / env_file / -e	[Container]	Environment= / EnvironmentFile=	Sensitive password, token, and key entries extract into <stack>.env with chmod 600.
depends_on	[Unit]	After=<dep>.service + Requires=	Starts PostgreSQL, MariaDB, and Redis units before dependent web or worker units.
networks (or stack default)	[Container] + .network	Network=<stack>.network	Creates an aardvark-dns bridge so peer containers resolve each other by service name.
restart: unless-stopped	[Service] + [Install]	Restart=always + WantedBy=	systemd restarts crashed containers and launches units on boot or user linger.
healthcheck.test / interval	[Container]	HealthCmd= / HealthInterval=	Translates CMD and CMD-SHELL probes along with retries, timeout, and start_period.
devices / cap_add / user	[Container]	AddDevice= / AddCapability= / User=	Passes /dev/dri GPU render nodes and scoped Linux capabilities without --privileged.
io.containers.autoupdate	[Container]	AutoUpdate=registry	Works with podman-auto-update.timer to pull newer image digests and roll services.

Frequently asked questions

How do I activate automatic image updates with generated Quadlet units?: Keep AutoUpdate=registry enabled in the generator, verify every Image= line uses a fully qualified registry domain, and enable the timer with systemctl --user enable --now podman-auto-update.timer.
How can I preview the compiled systemd service output before starting containers?: Copy the generated files into ~/.config/containers/systemd/ and run /usr/libexec/podman/quadlet -dryrun -user in your terminal to inspect the exact ExecStart podman run invocation and catch syntax issues.
Can rootless Podman bind Caddy to ports 80 and 443?: Rootless users cannot bind ports below 1024 by default on Linux. Either publish higher host ports such as 8080:80 and 8443:443, route traffic with firewalld, or lower net.ipv4.ip_unprivileged_port_start=80 via sysctl.
What replaces podman generate systemd in modern Podman releases?: Upstream Podman deprecated podman generate systemd in favor of Quadlet declarative unit files because Quadlet adapts container lifecycle flags across Podman upgrades without regenerating static shell wrappers.

Focused Workflows

Switch to another browser-local QuadletGen preset or read the systemd dry-run verification guide.

Core YAML Converter

Docker Compose to Podman Quadlet Converter

Free browser-local Docker Compose to Quadlet converter. Compile compose.yaml into Podman systemd .container, .network, .volume, and .env ZIP units.

Open Compose to Quadlet ->

CLI Flag Parser

Docker Run and Podman Run to Quadlet Converter

Paste any docker run or podman run command into this Podman run to Quadlet converter to generate clean .container systemd units with ports and mounts.

Open Docker Run to Quadlet ->

SELinux :z / :Z Mounts

Rootless Podman Quadlet Volume and SELinux Label Generator

Configure rootless Podman Quadlet volume z and Z bind mount labels for Fedora, RHEL, Bluefin, and CoreOS without permission denied container errors.

Open Rootless & SELinux ->

Self-Hosted Stacks

Podman Quadlet Examples for Immich, Nextcloud, and Vaultwarden

Ready-to-deploy Podman Quadlet Docker Compose examples for Immich, Nextcloud, Vaultwarden, and Postgres stacks with shared DNS networks and volumes.

Open Self-Hosted Templates ->

Multi-Unit ZIP Bundle

Podlet Online Multi-Container Quadlet Network and ZIP Packager

Run a Podlet online workflow in your browser without Cargo or Rust. Package Compose stacks into linked .container, .network, .volume, and .env ZIPs.

Open Podlet Online Packager ->

Architecture & Dry-Run Guide

QuadletGen Conversion Rules and systemd Dry-Run Verification

Review how QuadletGen synthesizes .container, .network, .volume, and .env units locally and how to verify syntax with podman/quadlet --dryrun.

Read architecture guide ->

How QuadletGen compares with containers/podlet CLI and Podman Desktop

Choose the right workflow for converting Compose stacks and container commands into Podman systemd units.

Capability	QuadletGen (Web)	containers/podlet CLI	Podman Desktop
Host setup required	Zero installation in any browser	Rust Cargo build, distro package, or container image	Desktop GUI plus local Podman machine and extension
Multi-file stack preview	Live unit tabs, combined view, and one-click .zip bundle	Writes separate files to disk or stdout per CLI run	Inspects running local pods or containers one by one
Shared .network synthesis	Automatic <stack>.network generation on toggle	Converts declared Compose networks via CLI flags	Depends on existing local Podman network state
SELinux :z and :Z volume toggle	Instant switch across none, shared :z, and private :Z	Manual volume string editing in input YAML or flags	Manual edit after generating the unit file
Secret .env extraction	Extracts sensitive keys into <stack>.env with EnvironmentFile=	Preserves inline environment entries unless pre-split	Inline Environment= lines by default
Data privacy	100% client-side JavaScript with zero server uploads	Local binary execution	Local desktop execution