When should I choose private-Z instead of shared-z for rootless Podman volumes?

Choose private-Z when a host directory belongs exclusively to one container, such as MariaDB or PostgreSQL data directories. Choose shared-z when two or more containers mount the exact same host path, such as an application container and a web server container.

Are there host directories where I should never apply :z or :Z?

Never bind-mount broad system paths such as /, /etc, /usr, /var, or your top-level /home/$USER directory with :z or :Z. Relabeling those directories changes SELinux contexts needed by sshd and systemd. Always create dedicated subdirectories such as ~/containers/nextcloud/html.

How do I keep rootless Quadlet containers running after reboot without logging in?

Run sudo loginctl enable-linger $USER once on the host. That starts your systemd --user manager at boot and launches every Quadlet unit carrying WantedBy=default.target.

Why extract secrets to an .env file on rootless Linux hosts?

Storing passwords in ~/.config/containers/systemd/ .env with chmod 600 keeps plaintext database credentials out of unit files that you may commit to a dotfiles or Ansible repository.

Podman 4.4+ systemd unit preset Scope: rootless

Rootless Podman Quadlet Volume and SELinux Label Generator

Build rootless Podman Quadlet units tailored for SELinux-enforcing Linux distributions including Fedora Server, Fedora CoreOS, RHEL 9, CentOS Stream, and Universal Blue. Append private :Z or shared :z bind mount labels automatically and isolate database credentials into a dedicated .env file.

Compose -> Quadlet Cheat Sheet Technical Notes Preset FAQ Related Generators

1-Click Stack Quick-Load Zero server uploads. Runs locally in browser memory.

Sample Stack Template

Stack Name Prefix

Install Scope

SELinux Mounts

AutoUpdate=registry Generate shared .network Extract secrets to .env

Drop compose.yaml / .txt here or browse .yml .yaml .txt

Detected mode: compose-yaml | Generated units: 7 (3 services) | Target directory: ~/.config/containers/systemd/

3 .container units .network DNS: nextcloud.network (aardvark-dns) 2 .volume units .env secrets: nextcloud.env (chmod 600) Install path: ~/.config/containers/systemd/

Compose YAML or Docker / Podman Run Input Mode: compose-yaml

Generated Quadlet systemd Units

# === nextcloud.container (~/.config/containers/systemd/nextcloud.container) ===
[Unit]
Description=nextcloud nextcloud container
Wants=network-online.target
After=network-online.target
After=nextcloud-network.service
After=mariadb.service
Requires=mariadb.service
After=redis.service
Requires=redis.service

[Container]
Image=docker.io/library/nextcloud:30-apache
ContainerName=nextcloud
Network=nextcloud.network
PublishPort=8080:80
Volume=nextcloud-html.volume:/var/www/html:Z
Volume=/srv/nextcloud/data:/var/www/html/data:Z
EnvironmentFile=%h/.config/containers/systemd/nextcloud.env
Environment=MYSQL_HOST=mariadb
Environment=MYSQL_DATABASE=nextcloud
Environment=MYSQL_USER=nextcloud
Environment=REDIS_HOST=redis

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=default.target

# === mariadb.container (~/.config/containers/systemd/mariadb.container) ===
[Unit]
Description=nextcloud mariadb container
Wants=network-online.target
After=network-online.target
After=nextcloud-network.service

[Container]
Image=docker.io/library/mariadb:11.4
ContainerName=mariadb
Network=nextcloud.network
Exec=--transaction-isolation=READ-COMMITTED --log-bin=binlog --binlog-format=ROW
Volume=mariadb-data.volume:/var/lib/mysql:Z
EnvironmentFile=%h/.config/containers/systemd/nextcloud.env
Environment=MYSQL_DATABASE=nextcloud
Environment=MYSQL_USER=nextcloud

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=default.target

# === redis.container (~/.config/containers/systemd/redis.container) ===
[Unit]
Description=nextcloud redis container
Wants=network-online.target
After=network-online.target
After=nextcloud-network.service

[Container]
Image=docker.io/library/redis:7-alpine
ContainerName=redis
Network=nextcloud.network

[Service]
Restart=always
TimeoutStartSec=900

[Install]
WantedBy=default.target

# === nextcloud.network (~/.config/containers/systemd/nextcloud.network) ===
[Unit]
Description=nextcloud shared Podman network

[Network]
NetworkName=nextcloud

# === nextcloud-html.volume (~/.config/containers/systemd/nextcloud-html.volume) ===
[Unit]
Description=nextcloud-html Podman volume

[Volume]
VolumeName=nextcloud-html

# === mariadb-data.volume (~/.config/containers/systemd/mariadb-data.volume) ===
[Unit]
Description=mariadb-data Podman volume

[Volume]
VolumeName=mariadb-data

# === nextcloud.env (~/.config/containers/systemd/nextcloud.env) ===
MYSQL_PASSWORD=nextcloud-db-secret
MYSQL_ROOT_PASSWORD=mariadb-root-secret

systemd Deployment & Reload Commands

mkdir -p ~/.config/containers/systemd
chmod 600 ~/.config/containers/systemd/nextcloud.env
systemctl --user daemon-reload && systemctl --user start nextcloud.service mariadb.service redis.service
systemctl --user status nextcloud.service mariadb.service redis.service
loginctl enable-linger $USER

Technical notes for Rootless & SELinux

01
Private :Z relabels a host bind directory with an exclusive Multi-Category Security (MCS) context so only that single container can read or write the files.
02
Shared :z applies a group container_file_t label without container-exclusive MCS categories, which is required when Nextcloud and Nginx or backup sidecars mount the same host path.
03
Named Podman volumes (.volume units) live under ~/.local/share/containers/storage/volumes/ and receive SELinux labels from Podman automatically without needing :Z.
04
Rootless services stop when your last SSH session closes unless user lingering is enabled via sudo loginctl enable-linger $USER.

Syntax Mapping Reference

Compose Key -> Quadlet Directive Cheat Sheet

Quick lookup for how Compose YAML fields and docker or podman run flags translate into Podman systemd unit directives.

Compose Key / CLI Flag	Unit Section	Quadlet Directive	Linux systemd Behavior
services.<app>.image	[Container]	Image=docker.io/library/...	Use a fully qualified registry host when AutoUpdate=registry is enabled.
ports: ["8080:80"] / -p	[Container]	PublishPort=8080:80	Repeats once per published host port; supports bind IP and /udp protocol suffixes.
volumes: ["./data:/data"] / -v	[Container] + .volume	Volume=/srv/data:/data:Z	Named volumes map to <name>.volume units; bind mounts append :z or :Z on SELinux hosts.
environment / env_file / -e	[Container]	Environment= / EnvironmentFile=	Sensitive password, token, and key entries extract into <stack>.env with chmod 600.
depends_on	[Unit]	After=<dep>.service + Requires=	Starts PostgreSQL, MariaDB, and Redis units before dependent web or worker units.
networks (or stack default)	[Container] + .network	Network=<stack>.network	Creates an aardvark-dns bridge so peer containers resolve each other by service name.
restart: unless-stopped	[Service] + [Install]	Restart=always + WantedBy=	systemd restarts crashed containers and launches units on boot or user linger.
healthcheck.test / interval	[Container]	HealthCmd= / HealthInterval=	Translates CMD and CMD-SHELL probes along with retries, timeout, and start_period.
devices / cap_add / user	[Container]	AddDevice= / AddCapability= / User=	Passes /dev/dri GPU render nodes and scoped Linux capabilities without --privileged.
io.containers.autoupdate	[Container]	AutoUpdate=registry	Works with podman-auto-update.timer to pull newer image digests and roll services.

Frequently asked questions

When should I choose private-Z instead of shared-z for rootless Podman volumes?: Choose private-Z when a host directory belongs exclusively to one container, such as MariaDB or PostgreSQL data directories. Choose shared-z when two or more containers mount the exact same host path, such as an application container and a web server container.
Are there host directories where I should never apply :z or :Z?: Never bind-mount broad system paths such as /, /etc, /usr, /var, or your top-level /home/$USER directory with :z or :Z. Relabeling those directories changes SELinux contexts needed by sshd and systemd. Always create dedicated subdirectories such as ~/containers/nextcloud/html.
How do I keep rootless Quadlet containers running after reboot without logging in?: Run sudo loginctl enable-linger $USER once on the host. That starts your systemd --user manager at boot and launches every Quadlet unit carrying WantedBy=default.target.
Why extract secrets to an .env file on rootless Linux hosts?: Storing passwords in ~/.config/containers/systemd/<stack>.env with chmod 600 keeps plaintext database credentials out of unit files that you may commit to a dotfiles or Ansible repository.

Focused Workflows

Switch to another browser-local QuadletGen preset or read the systemd dry-run verification guide.

Core YAML Converter

Docker Compose to Podman Quadlet Converter

Free browser-local Docker Compose to Quadlet converter. Compile compose.yaml into Podman systemd .container, .network, .volume, and .env ZIP units.

Open Compose to Quadlet ->

AutoUpdate + systemd

Podman Quadlet Generator for Declarative systemd Services

Interactive Podman Quadlet generator for declarative systemd services. Configure AutoUpdate=registry, health checks, rootless paths, and .env files.

Open Quadlet Generator ->

CLI Flag Parser

Docker Run and Podman Run to Quadlet Converter

Paste any docker run or podman run command into this Podman run to Quadlet converter to generate clean .container systemd units with ports and mounts.

Open Docker Run to Quadlet ->

Self-Hosted Stacks

Podman Quadlet Examples for Immich, Nextcloud, and Vaultwarden

Ready-to-deploy Podman Quadlet Docker Compose examples for Immich, Nextcloud, Vaultwarden, and Postgres stacks with shared DNS networks and volumes.

Open Self-Hosted Templates ->

Multi-Unit ZIP Bundle

Podlet Online Multi-Container Quadlet Network and ZIP Packager

Run a Podlet online workflow in your browser without Cargo or Rust. Package Compose stacks into linked .container, .network, .volume, and .env ZIPs.

Open Podlet Online Packager ->

Architecture & Dry-Run Guide

QuadletGen Conversion Rules and systemd Dry-Run Verification

Review how QuadletGen synthesizes .container, .network, .volume, and .env units locally and how to verify syntax with podman/quadlet --dryrun.

Read architecture guide ->

How QuadletGen compares with containers/podlet CLI and Podman Desktop

Choose the right workflow for converting Compose stacks and container commands into Podman systemd units.

Capability	QuadletGen (Web)	containers/podlet CLI	Podman Desktop
Host setup required	Zero installation in any browser	Rust Cargo build, distro package, or container image	Desktop GUI plus local Podman machine and extension
Multi-file stack preview	Live unit tabs, combined view, and one-click .zip bundle	Writes separate files to disk or stdout per CLI run	Inspects running local pods or containers one by one
Shared .network synthesis	Automatic <stack>.network generation on toggle	Converts declared Compose networks via CLI flags	Depends on existing local Podman network state
SELinux :z and :Z volume toggle	Instant switch across none, shared :z, and private :Z	Manual volume string editing in input YAML or flags	Manual edit after generating the unit file
Secret .env extraction	Extracts sensitive keys into <stack>.env with EnvironmentFile=	Preserves inline environment entries unless pre-split	Inline Environment= lines by default
Data privacy	100% client-side JavaScript with zero server uploads	Local binary execution	Local desktop execution