---
name: podman
description: Use when building images, running the local pod boot test, or reasoning about the two-container body and its boundaries.
---

Your body runs as a rootless Podman pod: `will-service` (read-only rootfs,
no capabilities) and `will-agent` (you, with sudo inside only). Image builds
use the Containerfiles; bases are digest-pinned and rebuilt deliberately
(`mise run base-service` / `base-agent`), never implicitly. Rollback means
redeploying a previous image digest, never rebuilding a revert. For local
verification run `mise run boot-test`. You have no access to the host socket;
that is by design. Reference: https://docs.podman.io/.