Containers

The root filesystem is immutable at runtime. uCore is designed for running services as containers rather than installing packages into the running base. Make persistent changes to the OS through an image build.

Podman is the expected container runtime. Docker’s Moby engine is also installed, with Docker Buildx and Compose. docker.socket is disabled by default; Fedora CoreOS cautions against running Docker and Podman workloads simultaneously. Use both only when you understand the interaction between their container and network stacks.

Container restart at boot

By default, uCore does not start restart: always containers at boot. For rootless containers under the core user, enable the user-level restart service:

shellcore user / enable Podman restart serviceCOPY

$ mkdir -p /var/home/core/.config/systemd/user$ cp /lib/systemd/system/podman-restart.service \    /var/home/core/.config/systemd/user$ systemctl --user enable podman-restart.service$ systemctl --user list-unit-files | grep podman

You may also need user lingering to keep interactive rootless containers alive after logout:

shellcore user / enable lingeringCOPY

$ loginctl enable-linger $UID

For rootful containers, enable the system service:

shellRootful containers / enable restart serviceCOPY

$ sudo systemctl enable podman-restart.service

Podman and firewalld

Podman and firewalld reloads can conflict: a firewall-cmd --reload may remove firewall rules created by Podman. If this affects your host, enable the netavark firewalld reload service:

shellEnable Podman firewall rule restorationCOPY

$ sudo systemctl enable --now netavark-firewalld-reload.service

Included tools

ucore-minimal includes Podman, Docker/Moby, Compose tools, and a Cockpit Podman service. The Cockpit web service runs as a predefined Podman container; the cockpit-ws RPM is not installed. Image-specific additions are listed in Images and streams.

Source: uCore Podman guidance, Fedora CoreOS container FAQ. Checked September 18, 2026.