The open-source, daemonless container management tool Podman has released version 6.2, with expanded Kubernetes support, new Quadlet configuration options, native systemd support for WSL machines, and security fixes.
The release addresses CVE-2026-121885, which could allow untrusted container image labels to manipulate Podman’s auto-update mechanism to restart unintended systemd units. It also fixes CVE-2026-111361, a vulnerability involving potential bypasses of image digest and signature validation, and CVE-2026-123876, which could allow malicious containers to bypass a socket restriction in the default seccomp profile.
Kubernetes integration receives several improvements. The podman kube play command now supports a --validate option to control how unrecognized YAML fields are handled, while --label allows users to assign labels to containers, pods, volumes, and secrets created from Kubernetes manifests.
Additionally, a new --multiple-pods option allows Podman to create multiple pods when a Kubernetes deployment specifies more than one replica. In addition, podman kube play --build can now build container images from subdirectories within the main build context.
Podman 6.2 also changes how seccomp profiles are configured through Kubernetes YAML. The tool now reads the standard securityContext.seccompProfile field, while the older annotation-based configuration is deprecated and scheduled for removal in Podman 7.0.
For users managing containers through systemd, Quadlet gains two new configuration options. The Umask key in .container files sets the default file creation mask inside containers. SetMountsDependency controls whether generated systemd units use RequiresMountsFor, WantsMountsFor, or no dependency on their required mount paths.
For Windows users, Podman machines running through WSL now support native systemd, replacing the need for Podman’s custom systemd setup in new machines. Existing machines remain supported with the previous configuration. Importantly, the release requires WSL 2.5.1 or later, as developers recommend version 2.7.5 or newer for proper nftables networking support.
Moreover, podman push gains a --platform option, allowing users to push a single architecture-specific image manifest instead of an entire multi-platform manifest list.
Container auto-updates have also been improved, as the podman auto-update command is now available through the remote Podman client and supports a new --filter option for updating only matching containers.
One smaller behavioral change concerns podman exec. Attached sessions now forward signals to processes running inside containers. Pressing Ctrl+C should also terminate the process started by the command rather than only interrupting the local client.
Finally, the release includes numerous bug fixes, particularly for Podman machines on Windows. These address startup hangs involving Hyper-V and WSL providers, virtual machines becoming inaccessible after a host restart, startup healthcheck handling, and issues with shared directories.
For more information, see the changelog.
