Chapter 68: Podman in Depth: Install, Rootless Containers, Pods, Compose, Kube YAML and Alternatives

68.6 Alternatives and companions: Buildah, Skopeo, containerd with nerdctl, Rancher Desktop, Colima and Podman Desktop

By Ravindra Bagale · Last updated: 25 October 2026

Why: the problem

Docker made containers popular, but today a container is just an OCI image run by an OCI runtime, and many tools can do each part of the job. Knowing the main alternatives helps you choose the right tool for a laptop, a CI runner or a server, and it helps in interviews where the question 'what else can run containers besides Docker?' is common. This lesson tours the tools you will meet most often and shows each one doing real work on the orders image. The first group are Podman's companions from the same containers project. Buildah builds OCI images, from a Containerfile or step by step with shell commands, without a daemon and without root. Podman's own podman build actually uses Buildah inside. Skopeo inspects, copies and syncs images between registries without pulling them to local storage, which makes it the favourite tool for mirroring images into air-gapped registries at banks and telecoms, and for checking image digests in CI. The second group is the containerd world. containerd is the runtime under Docker Engine and under most managed Kubernetes services, including EKS, GKE and AKS. nerdctl is a Docker-compatible CLI for containerd, with compose support and rootless mode, and crictl is the debugging CLI that talks to any Kubernetes CRI runtime on a node. When you SSH into a Kubernetes node and docker is not installed, crictl is what you use. The third group are desktop apps that give you a Linux VM plus tools on macOS and Windows. Podman Desktop is free, open source and manages Podman machines, kind and minikube clusters. Rancher Desktop from SUSE bundles k3s with either containerd and nerdctl or dockerd. Colima is a light command-line tool for macOS that runs containerd or Docker in a Lima VM. Docker Desktop itself needs a paid subscription for companies with more than 250 employees or more than 10 million US dollars revenue, which is a big reason Indian IT services companies have moved developers to Podman Desktop or Rancher Desktop. We finish with a comparison table and a simple decision guide.

What: every term in plain English

• OCI — Open Container Initiative: the image, runtime and distribution standards.
• Buildah — Daemonless tool to build OCI images.
• Skopeo — Tool to inspect and copy images between registries without pulling.
• containerd — CNCF runtime used by Docker and most Kubernetes clusters.
• nerdctl — Docker-compatible CLI for containerd.
• crictl — CLI for any Kubernetes CRI runtime, used on nodes.
• CRI-O — Lightweight Kubernetes runtime used by OpenShift.
• Rancher Desktop — SUSE desktop app with k3s and containerd or dockerd.
• Colima — macOS CLI that runs containers in a Lima VM.
• Podman Desktop — Free GUI for Podman, kind, minikube and extensions.

How: step by step

1. Build the orders image with Buildah from a Containerfile. Image in local storage.
2. Build a small image step by step with Buildah commands. Image without Dockerfile.
3. Inspect a remote image with Skopeo. Digest and layers without pulling.
4. Copy an image between registries with Skopeo. Mirror done.
5. Run the same image with nerdctl. Container up on containerd.
6. Inspect containers on a kind node with crictl. Pods listed.
7. Compare desktop options. Table ready.
8. Pick a tool for three scenarios. Decision written.

A useful way to remember these tools is a factory with separate departments. Buildah is the workshop that makes the boxes, which are images. Skopeo is the delivery van that moves boxes between warehouses, the registries, without opening them. Podman, nerdctl and Docker are the shop counters where customers open a box and use what is inside, which is running a container. containerd and CRI-O are the machines behind the counter in big Kubernetes stores, and crictl is the technician's tool for looking inside those machines. Desktop apps are just a ready-made small factory on your laptop. Once you see which department a tool belongs to, choosing between them becomes simple.

Example 1: Buildah: build from a Containerfile and from plain commands

Goal. Buildah: build from a Containerfile and from plain commands.

buildah.sh

set -euo pipefail
sudo dnf install -y buildah skopeo || sudo apt-get install -y buildah skopeo
cd ~/podman-lab/orders-src
buildah bud -t localhost/orders-api:1.4.0 -f Containerfile .
ctr=$(buildah from docker.io/library/alpine:3.20)
buildah run "$ctr" -- apk add --no-cache curl
buildah copy "$ctr" ./healthcheck.sh /usr/local/bin/healthcheck.sh
buildah run "$ctr" -- chmod 0755 /usr/local/bin/healthcheck.sh
buildah config --entrypoint '["/usr/local/bin/healthcheck.sh"]' --label team=orders "$ctr"
buildah commit --rm "$ctr" localhost/orders-probe:1.0
buildah images --format '{{.Name}}:{{.Tag}} {{.Size}}'
podman run --rm localhost/orders-probe:1.0 http://example.com

What each line does

• buildah bud — Build-using-dockerfile: same Containerfile, same result as podman build.
• buildah from — Starts a working container from a base image, which you change with commands.
• buildah run / copy — Like RUN and COPY, but from a shell script, so you can use loops and conditions.
• chmod 0755 — Normal executable permission for a script; never open files to everyone.
• buildah commit — Saves the working container as an image in the storage Podman also reads.

Green output

$ bash buildah.sh
STEP 1/8: FROM docker.io/library/golang:1.25-alpine AS build
...
Successfully tagged localhost/orders-api:1.4.0
localhost/orders-api:1.4.0 21.4 MB
localhost/orders-probe:1.0 12.1 MB
docker.io/library/alpine:3.20 8.1 MB
probe http://example.com -> 200

Expected result. Buildah built both images without a daemon, and Podman ran the result immediately because they share one image store. CI teams at Red Hat and in OpenShift pipelines use buildah because it runs rootless inside a normal pod.

Example 2: Skopeo: inspect and mirror images without pulling

Goal. Skopeo: inspect and mirror images without pulling.

skopeo.sh

skopeo inspect --format '{{.Digest}} {{.Architecture}} {{len .Layers}} layers' \
  docker://docker.io/library/postgres:16-alpine
skopeo list-tags docker://docker.io/library/redis | grep -c '7\.'
export MIRROR_TOKEN=REPLACE_WITH_REGISTRY_TOKEN
printf '%s' "$MIRROR_TOKEN" | skopeo login --username ci-bot --password-stdin registry.example.com
skopeo copy --all docker://docker.io/library/postgres:16-alpine \
  docker://registry.example.com/mirror/postgres:16-alpine
skopeo inspect --format '{{.Digest}}' docker://registry.example.com/mirror/postgres:16-alpine
skopeo logout registry.example.com

What each line does

• skopeo inspect docker:// — Reads the manifest and config straight from the registry, no download of layers.
• list-tags — Lists every tag, handy for finding the latest patch release in scripts.
• --password-stdin — Keeps the placeholder token out of shell history and process lists.
• copy --all — Copies every architecture of a multi-arch image, so arm64 nodes also work.
• Same digest — Proves the mirror is byte-identical to the source.

Green output

$ bash skopeo.sh
sha256:4c1f...e9a2 amd64 9 layers
46
Login Succeeded!
Getting image list signatures
Copying 8 images generated from 8 images in list
Writing manifest list to image destination
sha256:4c1f...e9a2
Removed login credentials for registry.example.com

Expected result. The mirror has the same digest as Docker Hub, and nothing was stored locally. Banks such as ICICI and SBI run exactly this kind of skopeo sync job to feed air-gapped registries that their Kubernetes clusters pull from.

Example 3: containerd with nerdctl, and crictl on a Kubernetes node

Goal. containerd with nerdctl, and crictl on a Kubernetes node.

nerdctl.sh

nerdctl version --format '{{.Client.Version}}'
nerdctl run -d --name web -p 8088:80 docker.io/library/nginx:1.27-alpine
nerdctl ps --format '{{.Names}} {{.Status}} {{.Ports}}'
curl -s -o /dev/null -w '%{http_code}\n' localhost:8088
nerdctl compose -f ~/podman-lab/orders/compose.yaml config --services
nerdctl rm -f web
podman exec -it shop-control-plane crictl ps --name kube-apiserver -o table
podman exec -it shop-control-plane crictl images | head -4

What each line does

• nerdctl run — Same flags as docker run, but talks to containerd directly.
• nerdctl compose — Reads the same compose file; config --services lists services without starting them.
• shop-control-plane — The kind node from 67.3; with Podman as provider, kind nodes are Podman containers.
• crictl ps — Lists containers on the node through the CRI, the same view the kubelet has.
• crictl images — Shows images cached on the node, useful when a pod is stuck in ImagePullBackOff.

Green output

$ bash nerdctl.sh
2.2.0
web Up 0.0.0.0:8088->80/tcp
200
db
cache
api
web
CONTAINER      IMAGE          CREATED        STATE    NAME            POD
3a9f...        6b1c...        2 hours ago    Running  kube-apiserver  kube-apiserver-shop-control-plane
IMAGE                                      TAG       SIZE
docker.io/kindest/kindnetd                 v20250512 39MB
registry.k8s.io/coredns/coredns            v1.12.0   20.9MB
registry.k8s.io/etcd                       3.5.21-0  58.9MB

Expected result. The same image ran on containerd with nerdctl, and crictl showed the containers inside a Kubernetes node. That is the view you will need when debugging EKS or GKE nodes, where there is no Docker at all.

Every command, step by step (Podman lab)

1. Build

   buildah bud -t localhost/orders-api:1.4.0 .
   

   What it does: Image.

   Successfully tagged
   

2. From

   buildah from alpine:3.20
   

   What it does: Working ctr.

   alpine-working-container
   

3. Commit

   buildah commit --rm $ctr localhost/orders-probe:1.0
   

   What it does: Save.

   Writing manifest
   

4. Inspect

   skopeo inspect docker://docker.io/library/postgres:16-alpine
   

   What it does: Remote.

   Digest: sha256:4c1f...
   

5. Tags

   skopeo list-tags docker://docker.io/library/redis
   

   What it does: Tags.

   "7.4.2" ...
   

6. Copy

   skopeo copy --all docker://... docker://registry.example.com/...
   

   What it does: Mirror.

   Writing manifest list
   

7. Run

   nerdctl run -d -p 8088:80 nginx:1.27-alpine
   

   What it does: containerd.

   web
   

8. Ps

   nerdctl ps
   

   What it does: List.

   web Up
   

9. Node

   crictl ps
   

   What it does: CRI.

   kube-apiserver Running
   

10. Images

    crictl images
    

    What it does: Cache.

    registry.k8s.io/etcd
    

When it is red 1

error creating build container: short-name resolution enforced

Cause. Short base image name in Containerfile.

Fix, step by step

1. Use docker.io/library/... in FROM lines.

When it is red 2

skopeo: unauthorized: authentication required

Cause. Not logged in to the target registry.

Fix, step by step

1. skopeo login with --password-stdin and a token that can push.

When it is red 3

nerdctl: rootless containerd not running

Cause. containerd-rootless not set up.

Fix, step by step

1. Run containerd-rootless-setuptool.sh install, or use sudo nerdctl.

When it is red 4

crictl: connect: connect endpoint 'unix:///var/run/dockershim.sock'

Cause. Old default endpoint.

Fix, step by step

1. Set runtime-endpoint: unix:///run/containerd/containerd.sock in /etc/crictl.yaml.

When it is red 5

Docker Desktop requires a paid subscription

Cause. Large company licence terms.

Fix, step by step

1. Use Podman Desktop or Rancher Desktop, or buy the subscription.

Practice tasks

buildah images

skopeo inspect docker://...

skopeo list-tags docker://docker.io/library/redis

podman run --rm localhost/orders-probe:1.0

skopeo inspect --format '{{.Digest}}' ...

curl localhost:8088

crictl ps

cat proposal.md

Recap

• Buildah builds images and Skopeo moves them; both share Podman's storage.
• containerd runs most Kubernetes clusters; nerdctl is its docker-like CLI.
• crictl is the tool for debugging containers on Kubernetes nodes.
• Podman Desktop, Rancher Desktop and Colima replace Docker Desktop on laptops.
• Pick tools by job: build, copy, run locally, or debug a cluster node.

FAQ

Q. Do I still need Docker at all?

For learning and most jobs, no. Podman covers local work, Buildah and Kaniko cover CI builds, and Kubernetes uses containerd or CRI-O. You still need to understand Docker because most documentation and Dockerfiles use its terms.

Q. Which desktop app should a beginner use?

On macOS or Windows, Podman Desktop if you follow this course, because it matches every Podman command here. Rancher Desktop if you want a built-in Kubernetes with one click. Colima if you prefer a small CLI and use Docker or nerdctl commands.

Q. What is CRI-O?

A small runtime made only for Kubernetes, used by OpenShift. It shares libraries with Podman, so images and storage behave the same way.

Q. Is Kaniko an alternative to Buildah?

Yes, for building inside Kubernetes pods without privileges. Buildah can do the same rootless; teams pick whichever their CI platform documents best.

Q. Can these tools all read the same images?

Yes. Every tool here speaks OCI, so an image built by Buildah runs on nerdctl, crictl, Docker and Kubernetes without conversion; only the local storage location differs between them.

Interview questions

1. Name alternatives to Docker for running containers.

   Model answer: Podman, containerd with nerdctl, CRI-O, and desktop apps like Rancher Desktop and Colima.

2. What is the difference between Buildah and Podman?

   Model answer: Buildah focuses on building images with fine control; Podman runs containers and uses Buildah for podman build.

3. How do you copy an image between registries without Docker?

   Model answer: skopeo copy docker://source docker://dest, with --all for multi-arch.

4. How do you debug containers on an EKS node?

   Model answer: Use crictl ps, crictl logs and crictl inspect against containerd.

Samajla ka?