podup 1.7.0

Translate and run docker-compose files on rootless Podman
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150

<div align="center">

# podup

**docker-compose on rootless Podman — one static Rust binary. No daemon. No Python.**

![peak memory ~7 MiB](https://img.shields.io/badge/peak_memory-~7_MiB-3fb950)
![daemon none](https://img.shields.io/badge/daemon-none-3fb950)
![rootless](https://img.shields.io/badge/rootless-native-3fb950)
![Podman 5 & 6](https://img.shields.io/badge/Podman-5_%26_6-892ca0)

[![CI](https://github.com/Glyndor/podup/actions/workflows/ci.yml/badge.svg)](https://github.com/Glyndor/podup/actions/workflows/ci.yml)
[![crates.io](https://img.shields.io/crates/v/podup.svg)](https://crates.io/crates/podup)
[![MSRV](https://img.shields.io/badge/MSRV-1.85-orange.svg)](Cargo.toml)
[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)

[**Website**](https://glyndor.net/projects/podup) · [**Install**](#-install) · [**Quick start**](#-quick-start) · [**Benchmarks**](docs/benchmarks.md) · [**Docs**](docs/)

<img src="docs/assets/podup-demo.gif" alt="podup running a compose stack on rootless Podman" width="760">

</div>

---

## 📥 Install

### Debian / Ubuntu (apt) — recommended

Register the signed Glyndor repository and install — copy-paste:

```bash
curl -fsSLO https://apt.glyndor.net/glyndor-archive-keyring.deb
sudo dpkg -i glyndor-archive-keyring.deb
sudo apt update && sudo apt install podup
```

The keyring package registers `https://apt.glyndor.net` and ships the signing
key, so podup updates (and key renewals) arrive through `apt upgrade` — the apt
build omits self-update since apt owns upgrades. Signed, SHA-256 verified,
fail-closed. Requires **Podman ≥ 5.0** (rootless).

<details>
<summary><b>Other methods — Linux/macOS script · Windows · build from source · self-update · Podman version · platforms</b></summary>

### apt, one-liner (script)

Same as above via the install script (registers the repo, then installs):

```bash
curl -fsSL https://glyndor.net/podup/install/unix | bash -s -- --apt
```

### Linux / macOS (install script)

```bash
curl -fsSL https://glyndor.net/podup/install/unix | bash
```

### Windows (PowerShell)

```powershell
irm https://glyndor.net/podup/install/windows | iex
```

Both installers verify the Ed25519 signature over `SHA256SUMS` and fail closed
otherwise.

### Build from source

```bash
cargo build --release
```

### Self-update

```bash
podup update            # download and install the latest signed release
podup update --check    # report whether a newer release exists, install nothing
```

`podup update` replaces the running binary in place only after verifying the
release's Ed25519 signature and SHA-256 checksum — it fails closed otherwise. See
[docs/self-update.md](docs/self-update.md) for the trust model.

### Podman version

podup tracks the **latest stable Podman** and supports its **last two majors —
Podman 5.x and 6.x**. It talks to Podman's native libpod API (still versioned
5.x — 5.2.0 on Podman 6), so it needs **Podman ≥ 5.0**. Validated on **Podman
5.x (5.8.1) and 6.0.0** (the latter in CI against Fedora rawhide). Many distributions still ship 4.x — check
`podman --version` and upgrade if needed. Fedora, Debian trixie/sid and recent
Ubuntu releases carry 5.x; on an older release, install or upgrade Podman
following the official guide: <https://podman.io/docs/installation>.

### Platforms

Linux, macOS and Windows (x86_64 and arm64). On macOS and Windows podup talks to
the `podman machine` VM through its host-side `unix://` socket or `npipe://`
named pipe; the socket must be local (remote `tcp://`/`ssh://` are rejected).

</details>

## 🚀 Quick start

```bash
podup up -d      # start the stack in the current directory
podup ps         # see what's running
podup down -v    # tear down and remove volumes
```

[Every command →](docs/commands.md)

## ⚡ Why

Rootless-native libpod API, real compose-spec (`extends`, profiles,
`develop.watch`, inline secrets), and systemd Quadlet export —
[vs alternatives](docs/benchmarks.md#vs-alternatives) · [Rust library](https://docs.rs/podup).

```mermaid
sequenceDiagram
    autonumber
    participant Y as docker-compose.yml
    participant P as podup
    participant L as Podman · libpod REST
    Y->>P: parse · substitute · resolve depends_on
    P->>L: create networks · volumes · secrets
    P->>L: start containers in order
    L-->>P: health / status
    P-->>Y: stack up
```

## 📊 Benchmarks

<div align="center">

### ~7 MiB flat memory &nbsp;•&nbsp; near-zero CPU &nbsp;•&nbsp; up to 15× faster than podman-compose

<img src="docs/assets/bench.svg" alt="Bar chart: podup uses ~7 MiB vs 69 MiB for podman-compose, and is 7–15x faster per op" width="760">

</div>

Same Podman, same digest-pinned images, median of 10 runs. [Full tables & methodology →](docs/benchmarks.md)

## 📖 Docs

[Commands](docs/commands.md) · [Migrating from Compose](docs/docker-migration.md) · [Benchmarks](docs/benchmarks.md) · [Self-update](docs/self-update.md) · [Security model](docs/security-model.md)

## License

[Apache-2.0](LICENSE) — report vulnerabilities privately via the **Security** tab, never in a public issue.