A webinar on Podman Desktop for teams looking for Docker Desktop alternatives. Covers migration, Kubernetes alignment, and a preview of sandboxed AI agent development.

Key takeaways:

• Drop-in Docker compatibility with a daemonless security model.
• Native pod + K8s manifest support for local-to-prod consistency.
• Enterprise fleet management and support.

Hoping someone can help me out with an issue I've been having for a long while.

I'm running RHEL 10.2 Gnome 49, trying to use an X application inside of a podman container with a custom network.

"podman network create --internal pod_dev"

I pass in all the environment variables and files that I know and what AI also says i need. I can not for the life of me get the x application to display.

It works in fedora 44, and Ubuntu, but RHEL 10 is kicking my butt.. if i do --net=host is am able to get the x application to work, but I have to have the container have its own IP.

And advice at all is appreciated, I've probably spent over 100 hours trying different combinations of flags and ways to run.

Hoping someone can help me out with an issue I've been having for a long while.

I'm running RHEL 10.2 Gnome 49, trying to use an X application inside of a podman container with a custom network.

"podman network create --internal pod\_dev"

I pass in all the environment variables and files that I know and what AI also says i need. I can not for the life of me get the x application to display.

It works in fedora 44, and Ubuntu, but RHEL 10 is kicking my butt.. if i do --net=host is am able to get the x application to work, but I have to have the container have its own IP.

And advice at all is appreciated, I've probably spent over 100 hours trying different combinations of flags and ways to run.

UPDATE:

I found a narrower fix. You do not need --security-opt label=disable. The ROCm Memory in use error was SELinux denying the container from mapping /dev/kfd. The AVC log showed a denial for map on /dev/kfd with type hsa_device_t. audit2allow pointed to the container_use_devices boolean, which covers this access.

Enable the boolean:

sudo setsebool -P container_use_devices 1

Then recreate or restart the container without --security-opt label=disable.

Previously

I ran into a weird issue running Ollama with ROCm in a rootless Podman container on Fedora. Models downloaded fine, but loading any model crashed with:

Memory critical error by agent node-0 ... Reason: Memory in use
llama-server process has terminated: signal: aborted (core dumped)

Setup:

• Fedora
• RX 6800 XT, gfx1030
• Rootless Podman
• Image: ollama/ollama:rocm
• GPU devices passed with: --device /dev/kfd --device /dev/dri

The container started, the GPU was detected, and the ROCm libraries inside the image looked fine. But every model load crashed with the memory error above.

What it was not. I checked:

• Device permissions: /dev/kfd and /dev/dri/renderD128 were accessible with read/write
• Missing ROCm libraries: the image already has them, and it detected the GPU
• HSA_OVERRIDE_GFX_VERSION: not needed in my case
• memlock limits: I raised the hard memlock limit for my user, but it made no difference

One clue that sent me down the wrong path: the same container worked when run rootful. That made me think it was a user namespace / memlock / permission issue, but it was not.

What fixed it:

--security-opt label=disable

The error message is misleading. My best guess is that SELinux is blocking the container process from mapping GPU memory through /dev/kfd, even though opening the device succeeds. That makes ROCm report something like "Memory in use", which is confusing because it is not actually a host RAM issue.

I did not confirm this in the SELinux audit log, so treat that part as a likely explanation rather than a proven root cause.

Working command:

podman run -d --device /dev/kfd --device /dev/dri --security-opt label=disable -v ollama:/root/.ollama -p 11434:11434 --name ollama docker.io/ollama/ollama:rocm

I searched Reddit for a while and couldn't find anything similar, so hopefully this saves someone a few hours of head-scratching. Happy hacking.