Podman is what Docker should have been, for me. Security first, no daemon, more Linux-like behavior (You can manage them with SystemD unit files if you wish) and it supports the same, usual container images you build/use with Docker.

The main part it was lacking is the compose equivalent, but that too is coming along.

Does it support higher-level declarations like Deployments and StatefulSets? I'm trying to understand how/if we could use this without having to write new manifests. A (very) quick search didn't clarify it for me.

See my other comment in a recent thread [0]

[0] : https://news.ycombinator.com/item?id=37661056

Selinux is neat but is IMO conceptually wrong in a container world. UIDs and are barely better. At most, these mechanisms should confirm that the container as a whole has a given permission, and that’s it.

(Seriously, the major clouds have deprecated per-object permissions on their object stores. IMO they are right to have done so.)

Podman's use of SELinux prevents and mitigates many of these issues what you will have if somone targets your app.

the reality though is that you can install both docker and podman, and just start/stop docker as necessary. its easy enough to experiment with podman on a system with docker installed.

imo it's similar to folks that think learning a new shell is a huge undertaking. the reality is you just install the new thing and drop in and out of it as you get comfortable. if it sticks, cool, if not, also cool.