Podman 6.0 Migration Guide: cgroups v1, iptables, CNI Removed—What to Upgrade

Podman 6.0 has arrived as a major release of the open-source container engine, replacing several legacy Linux container assumptions with newer defaults while dropping support for cgroups v1, iptables, CNI networking, slirp4netns, BoltDB, Windows 10, and Intel Macs. That makes this less a feature release than a line in the sand. The new AMD GPU support and Podman Machine improvements are welcome, but the real story is that Podman is choosing a smaller, cleaner future over broad compatibility with yesterday’s systems.

Futuristic “Podman 6.0” tech poster with a container tank, networking flow, and system features.Podman Stops Pretending the Old Stack Is Still the Default​

For years, Podman’s pitch has been deceptively simple: containers without a daemon, with strong Linux-native integration and enough Docker compatibility to keep muscle memory intact. Podman 6.0 keeps that identity, but it changes the bargain. If older hosts, older networking assumptions, or older client platforms are still part of your workflow, this release is not asking politely.
The headline removals are blunt. cgroups v1 is gone, nftables replaces iptables as the required firewall layer, CNI networking gives way to Netavark, and slirp4netns is replaced by Pasta for rootless networking. These are not cosmetic changes hidden behind a compatibility shim. They affect how containers are isolated, how networks are built, how firewall rules are expressed, and how rootless workloads reach the outside world.
That makes Podman 6.0 a modernization release in the most literal sense. The project is deleting code paths that once made Podman more adaptable across strange distributions and aging hosts. In return, maintainers get a container engine that can move faster around a narrower set of assumptions.
For administrators, that trade-off is familiar. Every platform eventually reaches the point where backwards compatibility becomes the tax that blocks meaningful progress. Podman 6.0 is the moment the bill comes due.

The Breaking Changes Are the Feature​

It is tempting to read the new capabilities first: AMD GPU support, Podman Machine improvements, Quadlet changes, volume-prune safeguards, and better Docker-aligned behavior. But the defining feature of Podman 6.0 is subtraction. The release removes enough old infrastructure that an upgrade plan now matters as much as the upgrade itself.
The end of cgroups v1 support is the clearest signal. Modern Linux distributions have been pushing cgroups v2 for years, and container runtimes have steadily converged around it because it provides a cleaner hierarchy and better resource-control semantics. Podman 6.0 no longer treats cgroups v1 as a viable fallback. If your estate still includes older kernels or distributions frozen on the previous model, Podman 6.0 is effectively telling you to modernize the host before modernizing the runtime.
The iptables removal follows the same logic. nftables has been the direction of travel for Linux firewalling for a long time, but many administrators still think in iptables rules, wrappers, and accumulated scripts. Podman dropping iptables support means those environments cannot keep treating nftables as an implementation detail. The firewall layer is now part of the migration conversation.
CNI’s removal is more emotionally complicated. CNI was widely understood, widely scripted, and widely integrated. Netavark and Aardvark have been Podman’s preferred path for some time, offering better alignment with Podman’s own networking model, but the loss of CNI will still sting in environments where container networks have been treated as durable local infrastructure rather than disposable runtime state.
The slirp4netns removal is similarly consequential for rootless users. Rootless containers have always been one of Podman’s strongest arguments, especially for developers and security-minded operators who dislike giving a container runtime broad host privileges. Moving to Pasta may be technically sensible, but any change at this layer can expose assumptions about port forwarding, source addresses, DNS behavior, and local development workflows.

Windows Users Get a Narrower Door Into the Linux Container World​

For WindowsForum readers, the Windows 10 removal is not a footnote. Podman has never been a native Windows container engine in the same sense that Docker Desktop is a packaged developer platform, but Podman Machine made it a practical option for running Linux containers through virtualized environments. With Podman 6.0, Windows 10 falls off the supported list.
That aligns with the broader industry shift toward Windows 11 as the baseline for developer tooling, virtualization improvements, and security posture. It also creates a familiar problem for organizations that standardized on Windows 10 and are still working through hardware, policy, or application-compatibility blockers. Podman 6.0 is not going to be the reason most companies migrate to Windows 11, but it is one more pressure point in a growing stack of developer-tool assumptions.
The removal matters most in mixed fleets. A developer on Windows 11, a CI runner on Fedora, a lab box on Ubuntu, and a production host on RHEL can already produce subtle differences in container behavior. Removing Windows 10 support simplifies the supported matrix for Podman maintainers, but it leaves organizations to decide whether they pin older Podman versions for lagging client systems or accelerate workstation upgrades.
Intel Mac support is also gone, which tells the same story from Apple’s side of the desk. The container tooling ecosystem has largely accepted Apple Silicon as the future of macOS development. Podman 6.0 makes that acceptance explicit. Old client hardware is no longer a design center.
That does not mean Podman is abandoning cross-platform development. It means cross-platform support now assumes newer host platforms and newer virtualization paths. The bridge remains, but the boards under it have been replaced.

Podman Machine Becomes More Useful, but Less Forgiving​

Podman Machine receives a collection of improvements that make the virtualized experience more coherent across Linux, macOS, and Windows. Commands can now operate on virtual machines from any provider, regardless of the configured provider. That sounds minor until you remember how often developer machines accumulate tooling history: a VM created under one provider, a default later changed, a command that behaves as though only the current provider exists.
The new podman machine os update command is another sign that Podman Machine is being treated less like a throwaway convenience and more like a managed substrate. Updating the OS inside the VM gives administrators and developers a cleaner maintenance path, although the feature does not apply to the WSL provider. That exception matters on Windows, where WSL remains one of the most common routes into Linux-based development workflows.
The new --import-native-ca option is practical in the way enterprise developers will immediately recognize. Corporate networks often depend on internal certificate authorities for TLS inspection, private registries, internal APIs, and development endpoints. If a VM does not trust the same authorities as the host, container pulls and application tests fail in ways that look like network problems but are really trust-store drift. Importing host CA certificates into Podman Machine VMs reduces that friction.
There is a catch on Linux. Podman Machine VMs now mount host volumes using systemd, and that change breaks volume mounts on existing Linux Podman Machine VMs. The remedy is not a clever flag; those machines must be recreated. That is a perfect example of Podman 6.0’s character: better architecture, real breakage.
On macOS, the default Podman Machine provider changes to libkrun. That is another modernization choice, especially relevant in a world where Apple Silicon has reshaped the virtualization conversation. But like every provider change, it introduces the possibility that scripts, local assumptions, or performance expectations need to be retested.

Quadlet Moves Further Into the Systemd Mainstream​

Quadlet has become one of Podman’s more important differentiators because it translates container intent into systemd-managed services. For Linux administrators, that is not a small convenience. It means containers can be handled through the same service-management model used for the rest of the system.
Podman 6.0 continues that integration. The podman quadlet command now places Quadlets and associated files in subdirectories instead of tracking them through a .app file. That sounds like housekeeping, but it makes Quadlet assets easier to reason about, package, and distribute.
The release also adds UID=, GID=, and Options= support for .volume units. Volume behavior is often where declarative container management becomes messier than the demo suggests. Giving Quadlet more expressive control over volume ownership and options makes it more credible for real services, not just toy examples.
New search paths are designed to help distributions package and distribute Quadlets more easily. That may be one of the quieter long-term changes in the release. If distributions can ship Quadlet definitions in predictable places, Podman-managed services can start to feel more like first-class Linux packages rather than local admin inventions.
This is where Podman’s worldview is most visible. Docker compatibility still matters, but Podman’s center of gravity is Linux service management. Quadlet is not trying to hide systemd; it is trying to make containers legible to it.

Docker Compatibility Improves by Changing Podman’s Defaults​

Podman 6.0 includes several behavioral changes that bring it closer to Docker expectations. Network isolation is now enabled by default, which improves both Docker compatibility and the security posture of container networking. For users moving between tools, fewer surprises are a feature in themselves.
The podman commit command now pauses containers while committing changes. The point is straightforward: if a container continues writing while a commit is capturing its filesystem state, the resulting image can reflect concurrent modification. Pausing reduces that risk. Users who want the old behavior can restore it with --pause=false, but the default now favors safer snapshots over uninterrupted execution.
Volume pruning also changes in a Docker-aligned direction. podman volume prune now removes only unused anonymous volumes by default. Previously, Podman’s behavior could remove all unused volumes, which was powerful but potentially hazardous for users expecting Docker semantics. Those who want the broader cleanup must now pass --all.
The new --dry-run option for volume pruning is the sort of small feature that prevents large mistakes. Storage cleanup commands are inherently dangerous because the operator often discovers what mattered only after it is gone. Showing what would be removed before removing it is not glamorous, but it is exactly the kind of operational guardrail that mature tooling needs.
These changes reveal a subtler pattern. Podman is becoming more opinionated underneath while becoming less surprising at the command line. That is a smart balance if the project wants to court both Linux purists and Docker-trained developers.

AMD GPU Support Extends Podman Into a Hotter Workload Class​

The addition of AMD GPU compatibility to the --gpus option for podman create and podman run is one of the release’s most marketable features. GPU access inside containers is increasingly central to AI, media processing, scientific computing, and high-performance developer workflows. NVIDIA has dominated much of the container-GPU conversation, but AMD hardware is too common and too strategically important to ignore.
For Windows enthusiasts running Linux containers through VMs, this will not magically erase the complexity of GPU passthrough, driver stacks, or host virtualization limits. But at the container-engine level, the direction is clear. Podman wants the --gpus flag to be a general container capability rather than a vendor-shaped exception.
That matters because GPU workflows are among the least forgiving container workloads. A web service can often tolerate a slightly different network default or storage driver. A GPU workload may fail outright if devices, drivers, runtime hooks, or permissions are not aligned. First-class AMD support gives administrators another reason to test Podman in environments that previously assumed Docker-compatible GPU plumbing would be easier elsewhere.
The feature also lands at a time when local AI experimentation has made workstation-class GPUs newly relevant to developers who are not traditional HPC users. Containers are a natural way to package those stacks, but only if device access is predictable. Podman 6.0 does not solve the entire GPU-container problem, but it expands the supported map.

Networking Gets More Powerful as It Gets Less Backward-Compatible​

Networking is where Podman 6.0 asks the most from administrators. Removing CNI and slirp4netns is disruptive, but the release also adds capabilities that make the new stack more flexible. Containers can now use multiple static IP addresses by passing the ip= option to --net multiple times. That is a useful improvement for specialized service layouts and test environments where deterministic addressing matters.
podman network create can now create blackhole, unreachable, and prohibit routes. This gives administrators a direct way to block container access to specific networks at the container-network layer. In security-sensitive environments, that is more than a convenience. It helps encode network intent into the runtime configuration instead of leaving it scattered across host firewall rules and external policy.
The broader move to Netavark reflects Podman’s desire to own more of its networking story. CNI was a shared ecosystem interface, and that had advantages. But shared interfaces can also limit what a project can change, especially when it wants tighter integration with its own lifecycle, DNS, and rootless networking model.
The risk is that administrators who built tooling around CNI will experience the move as churn rather than progress. That is not an irrational reaction. A better container network stack is only better after the migration succeeds.

The Database Migration Is Quiet Until It Is Not​

BoltDB support is removed in Podman 6.0, with SQLite now the surviving path. When Podman starts on a system still using a BoltDB database, it attempts an automatic migration. Automatic is good, but anyone who has maintained stateful infrastructure knows that database migrations are where release notes become maintenance windows.
This is especially important because Podman state is not abstract. It tracks containers, images, volumes, networks, and runtime metadata that users expect to survive upgrades. If the migration works, most users will barely notice. If it does not, the problem will surface at exactly the wrong moment: after the new runtime is already installed.
The sane approach is therefore boring and necessary. Inventory systems before upgrading. Know which database backend they use. Back up what matters. Test the migration on representative machines rather than assuming a developer laptop tells you enough about production hosts.
There is a broader point here. Podman 6.0 removes several components that were already deprecated or superseded, but deprecation warnings are easy to ignore when systems keep working. Major releases are where ignored warnings become operational facts.

The Compatibility Matrix Is Now Part of the Upgrade​

Podman 6.0 must be paired with specific versions of the surrounding container tools: Buildah 1.44, Skopeo 1.23, Netavark and Aardvark 2.0, and configuration files from the container-libs common/v0.68 release. That matters because Podman is not a single binary living in isolation. It is part of a tools ecosystem that builds, pulls, inspects, runs, networks, and configures containers.
For distributions, this is a packaging coordination problem. For administrators, it is a repository and lifecycle problem. A half-upgraded container stack can be worse than an old one because failures become inconsistent and hard to diagnose. One component may expect the new network stack while another still assumes the old configuration model.
The import path change from github.com/containers/podman/v5 to go.podman.io/podman/v6 is mostly relevant to developers building against Podman internals or integrating the project into Go-based tooling. But it is also symbolic. Podman’s move to a CNCF-owned GitHub organization is not just governance theater; it changes how the project presents itself in the cloud-native ecosystem.
That ecosystem branding matters less to an admin trying to keep a containerized service alive on a Tuesday night. Still, it reinforces the same theme as the technical changes. Podman is formalizing, narrowing, and maturing.

The Small Changes Tell the Same Story​

Several smaller additions in Podman 6.0 are easy to skim past but fit the release’s pattern. podman exec gains a --no-session option that can improve performance by disabling API session tracking and database operations. podman image list --format json now includes Repository and Tag fields. Custom TLS tuning arrives through --tls-details.
CDI device reporting in podman info improves visibility into device integration, which matters for GPU and hardware-adjacent workloads. New lifecycle events for artifacts strengthen Podman’s handling of OCI artifacts as the container ecosystem expands beyond traditional images. These are not the changes that break your upgrade, but they are the changes that make the runtime feel more complete once the dust settles.
The connective tissue is operational clarity. Better JSON fields help automation. Better device reporting helps diagnostics. Better TLS tuning helps enterprise environments. Better artifact events help tooling observe more of the lifecycle.
Podman 6.0 is not merely ripping out old code. It is replacing loose edges with more explicit machinery.

The Upgrade Belongs in a Maintenance Window, Not a Coffee Break​

The practical advice is simple: do not treat Podman 6.0 as an ordinary package bump. If your systems are already modern, already on cgroups v2, already using nftables, already migrated to Netavark, already comfortable with Pasta, and already clear of BoltDB, the upgrade may be uneventful. But that is a lot of “already.”
The systems most likely to surprise you are the ones that have been quietly stable for years. A homelab host running an older distribution. A CI box nobody wants to rebuild. A developer workstation still on Windows 10. A rootless setup with carefully tuned slirp4netns behavior. A CNI network config copied forward from a previous era because it worked.
This is also where Windows admins should pay attention even if they do not run Podman in production. Developer tooling is increasingly tied to virtualization, Linux compatibility layers, internal certificates, and containerized build environments. A runtime dropping Windows 10 support is not just a Linux story. It is another reminder that the development workstation is now part of the infrastructure stack.
The best upgrades will look conservative. Pin versions until the surrounding tools are ready. Test network behavior explicitly. Recreate affected Podman Machine VMs where required. Validate volume pruning expectations before giving cleanup commands to automation.

The Release Notes Are Really a Migration Checklist​

Podman 6.0 rewards teams that have been following the project’s direction and punishes teams that used deprecation as a snooze button. The most concrete lessons are not hidden in the fine print; they are the fine print.
  • Systems still depending on cgroups v1, iptables, CNI, slirp4netns, BoltDB, Windows 10, or Intel Mac support should not move to Podman 6.0 without a migration plan.
  • Podman 6.0 needs a matched toolchain, including Buildah 1.44, Skopeo 1.23, Netavark and Aardvark 2.0, and the expected container-libs configuration files.
  • Existing Linux Podman Machine VMs may need to be recreated because host volume mounts now use systemd.
  • The new AMD GPU support makes Podman more attractive for AI, media, and compute workloads, but host driver and virtualization details still matter.
  • Docker-aligned behavior changes around network isolation, commits, and volume pruning should reduce surprises for many users while breaking assumptions for some existing scripts.
  • Administrators should test database migration, rootless networking, volume cleanup, and static network addressing before rolling the release into shared environments.
Podman 6.0 is the kind of release open-source infrastructure projects eventually need to make: unsentimental, disruptive, and healthier for it. The short-term cost is real, especially for users with old hosts or carefully preserved local workflows, but the long-term signal is equally clear. Podman is not trying to be the container engine that runs everywhere forever; it is trying to be the container engine that runs cleanly on the platforms that define the next decade of Linux and Windows-adjacent development.

References​

  1. Primary source: Linuxiac
    Published: Wed, 24 Jun 2026 20:22:12 GMT
  2. Related coverage: newreleases.io
  3. Related coverage: byteiota.com
  4. Related coverage: fedoraproject.org
  5. Related coverage: sysadmin.libhunt.com
  6. Related coverage: podman.io
  1. Related coverage: fossies.org
  2. Official source: github.com
  3. Related coverage: docs.podman.org.cn
  4. Related coverage: idroot.us
 

Back
Top