podup

Run Compose projects on rootless Podman. podup reads your compose.yaml and drives Podman through its native libpod API: one standalone binary, no daemon of its own, no Python.

Features

• 🔁 The Compose commands you know, with depends_on ordering and healthcheck conditions.
• 🧩 extends, profiles, include and develop.watch file sync.
• 🔐 Podman-native secrets and configs, including inline content:.
• ⚙️ systemd integration: export a project as Quadlet units, or start it at boot with podup autostart.
• 🛡️ podup audit flags risky settings in a Compose file before you run it.

Install

podup needs Podman 5.0 or newer, reached through a local socket, and runs on Linux, macOS and Windows (x86_64 and arm64). Debian 12 and Ubuntu 24.04 ship an older Podman; see Platforms.

curl -fsSL https://apt.glyndor.net/install/podup | sudo sh

On Debian and Ubuntu this adds the signed Glyndor apt repository and installs podup as a package, so apt upgrade keeps it current.

Optional: macOS, Windows and other Linux distributions

macOS (with a running podman machine):

brew install glyndor/tap/podup

Windows (with a running podman machine; Scoop needs git):

scoop bucket add glyndor https://github.com/Glyndor/scoop-bucket
scoop install podup

The Windows binary is not Authenticode-signed yet; with Smart App Control enabled it was reported blocked on 2026-09-22 (#1774). The Platforms section above describes the WSL route.

Other Linux distributions (needs curl, sha256sum, Python 3 with cryptography to verify the download, and write access or sudo for /usr/local/bin):

curl -fsSL https://glyndor.net/podup/install/unix | bash

This installs the release binary to /usr/local/bin; podup update keeps it current.

Quick start

On Linux with a systemd user session, enable the rootless Podman API socket once:

systemctl --user enable --now podman.socket

Then, in a directory with a Compose file:

podup up -d      # start the stack
podup ps         # list its containers
podup down       # remove containers and networks; volumes are kept

podup down -v also removes the project's named volumes and their data.

What podup up does

sequenceDiagram
    participant U as You
    participant P as podup
    participant L as Podman libpod API
    U->>P: compose.yaml + up
    P->>P: parse, interpolate, order by depends_on
    P->>L: create networks, volumes and secrets
    P->>L: start containers in dependency order
    L-->>P: health and status
    P-->>U: result

Loading

Compose files are trusted input: review their host mounts and commands before running them.

Performance

Client memory and latency against docker-compose and podman-compose on the same rootless Podman (podup 5.10.8, median of 10 measured runs):

Benchmarks has the method, all results and limitations.

Documentation

Guide	What it covers
Commands	Commands, options and environment settings
Migrating from Compose	Supported fields, differences, platforms
Autostart	Starting a project at boot, Quadlet export
Security model and threat model	What podup protects and what it assumes
Self-update	How podup update verifies a release
Debian packaging	The apt package and its update policy
Contributing	Building from source and the contribution flow

License

MIT. Report vulnerabilities privately through the Security tab, never in a public issue.