Podman

Podman is the drop-in Docker replacement that doesn't need a daemon running in the background. Same commands (`podman run`, `podman build`, `podman pull`) but no daemon process, no root access required, and the security model is fundamentally better.

Podman runs containers as your regular user by default (rootless). Each container is a child process of the podman command, not a daemon. If Podman crashes, your containers keep running. If Docker's daemon crashes, everything dies.

The Docker CLI compatibility is nearly perfect. Most people alias `docker` to `podman` and never notice the difference. Podman Compose exists for docker-compose files. Podman can build Dockerfiles. It pushes to and pulls from the same registries. Podman's unique feature: pods. Like Kubernetes pods, you can group containers that share network and storage. This makes it a natural stepping stone from local development to Kubernetes deployment.

The catch: "nearly perfect" Docker compatibility means occasionally you hit an edge case that works in Docker but not Podman. Rootless networking has quirks. Binding to ports below 1024 requires extra config. Docker Desktop's Kubernetes integration and extensions ecosystem doesn't exist in Podman. And some CI systems and dev tools assume Docker's socket API, requiring workarounds for Podman.