Podman Inspect: Inspect Containers, Images, Networks and Volumes

podman ps tells you what is running. podman inspect answers the next question: what image is it using, which IP did it get, what environment did you pass, and where are the mounts? The practical skill is not scrolling through JSON — it is pulling one reliable field with --format.

This guide uses Podman 5.8.2 on a rootful lab host. Every template below was tested against real containers.

Lab setup

Create a working directory for disposable objects:

mkdir -p ~/podman-inspect-lab && cd ~/podman-inspect-lab

Start an nginx container with environment variables and a published port:

podman run -d --name inspect-demo -e APP_ENV=production -e SECRET_TOKEN=do-not-log -p 8080:80 docker.io/library/nginx:alpine

Add a second container with volume, bind, and tmpfs mounts for mount-inspection examples:

podman volume create inspect-vol

Mount a volume, a read-only bind mount, and a tmpfs path on a long-running Alpine container:

podman run -d --name inspect-mount-demo -v inspect-vol:/data -v /etc/hosts:/etc/hosts:ro --tmpfs /tmp:rw,noexec docker.io/library/alpine:latest sleep 3600

Create a user-defined network and a small pod for later sections:

podman network create inspect-net

Create a pod for the later inspection example:

podman pod create --name inspect-pod

Add a workload container to the pod:

podman run -d --pod inspect-pod --name inspect-pod-web docker.io/library/alpine:latest sleep 3600

Inspect a Podman container

Dump the full JSON document for one container:

podman inspect inspect-demo

Sample output (trimmed):

[
     {
          "Id": "3d03aafd6603c9a7377440cabe27070bc0b4954829873ed2595a52c00fa6159e",
          "Created": "2026-08-23T08:09:36.598553277+05:30",
          "Path": "/docker-entrypoint.sh",
          "Args": [
               "nginx",
               "-g",
               "daemon off;"
          ],
          "State": {
               "Status": "running",
               "Running": true,
               "OOMKilled": false,
               "ExitCode": 0,
               "StartedAt": "2026-08-23T08:09:37.005274922+05:30",
               ...
          },
          "Image": "15c5ca5322ab6a09ed09f45b7e1983a91faf60834d442c3816981b944cd259d1",
          ...

Default output is JSON wrapped in an array. Useful top-level areas include identity (Id, Name), State, Image, Config (command and environment), HostConfig, Mounts, and NetworkSettings. You rarely need every key — the sections below show targeted extractions.

podman inspect supports multiple object types

Generic podman inspect accepts more than containers:

container
image
volume
network
pod
artifact

Inspect an image by reference:

podman inspect docker.io/library/alpine:latest --format '{{.Architecture}}'

Sample output:

amd64

Inspect a volume mount point:

podman volume inspect inspect-vol --format '{{.Mountpoint}}'

Sample output:

/var/lib/containers/storage/volumes/inspect-vol/_data

Inspect a network driver and DNS setting:

podman network inspect inspect-net --format '{{.DNSEnabled}}'

Sample output:

true

When a container and image share a name, generic inspect can resolve the wrong object. On this host, podman inspect inspect-demo returned the container even after an image was tagged inspect-demo:latest. That is why --type matters in scripts.

Specify the object type with --type

Force the object kind when names could collide:

podman inspect --type container inspect-demo --format '{{.Name}}'

Sample output:

inspect-demo

Target the image explicitly:

podman inspect --type image docker.io/library/alpine:latest --format '{{.Architecture}}'

Sample output:

amd64

Network objects work the same way:

podman inspect --type network inspect-net --format '{{json .Subnets}}'

Sample output:

[{"subnet":"10.89.1.0/24","gateway":"10.89.1.1"}]

Use --type anywhere ambiguity would break automation — CI jobs, config generators, or cleanup scripts that must not grab the wrong object.

Extract a single value with --format

Go templates read field names from the inspect JSON structure:

podman inspect --format '{{.State.Status}}' inspect-demo

Sample output:

running

Read the human-readable image reference:

podman inspect --format '{{.ImageName}}' inspect-demo

Sample output:

docker.io/library/nginx:alpine

Template field names match JSON keys. When you are unsure of the path, run plain podman inspect once, find the key, then narrow with --format.

Find a container IP address

On the default podman network, a single-line template is enough:

podman inspect --format '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' inspect-demo

Sample output:

10.88.3.97

After attaching a user-defined network, list every network with its address:

podman network connect inspect-net inspect-demo

Reinspect all attached networks — names matter when more than one interface exists:

podman inspect --format '{{range $name,$net := .NetworkSettings.Networks}}{{$name}} {{$net.IPAddress}}{{"\n"}}{{end}}' inspect-demo

Sample output:

inspect-net 10.89.1.2
podman 10.88.3.97

Do not hard-code network names in scripts unless you always attach the same network. Range over NetworkSettings.Networks and pick the entry you need.

Extract port mappings

Inspect exposes the full port map as JSON:

podman inspect --format '{{json .NetworkSettings.Ports}}' inspect-demo

Sample output:

{"80/tcp":[{"HostIp":"0.0.0.0","HostPort":"8080"}],"8080/tcp":null}

The 80/tcp entry shows container port 80 published to host 8080 on all interfaces. For day-to-day checks, Podman port mapping and podman port are often easier to read. Inspect shines when you need the raw structure for automation.

Inspect environment variables

List every variable Podman stored for the container:

podman inspect --format '{{range .Config.Env}}{{println .}}{{end}}' inspect-demo

Sample output (trimmed):

PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
container=podman
NGINX_VERSION=1.30.4
APP_ENV=production
SECRET_TOKEN=do-not-log

Filter one name in the shell when you only need a match:

podman inspect --format '{{range .Config.Env}}{{println .}}{{end}}' inspect-demo | grep '^APP_ENV='

Sample output:

APP_ENV=production

Environment values can contain secrets. Avoid dumping full Config.Env into shared logs or CI artifacts — extract only the keys you need.

Inspect mounts

JSON form shows driver, source, and destination for each mount:

podman inspect --format '{{json .Mounts}}' inspect-mount-demo

Sample output:

[{"Type":"volume","Name":"inspect-vol","Source":"/var/lib/containers/storage/volumes/inspect-vol/_data","Destination":"/data",...},{"Type":"bind","Source":"/etc/hosts","Destination":"/etc/hosts",...}]

A readable loop is easier to scan in scripts:

podman inspect --format '{{range .Mounts}}{{.Type}} {{.Source}} -> {{.Destination}}{{"\n"}}{{end}}' inspect-mount-demo

Sample output:

volume /var/lib/containers/storage/volumes/inspect-vol/_data -> /data
bind /etc/hosts -> /etc/hosts

Mount types you will see most often:

bind
volume
tmpfs

On Podman 5.8.2 the tmpfs mount on inspect-mount-demo did not appear in .Mounts even though --tmpfs /tmp was set at run time. When tmpfs matters, confirm in the full JSON or HostConfig rather than assuming .Mounts is complete. Volume permission troubleshooting belongs in Podman volumes, not here.

Inspect container state

State fields help when a container exited unexpectedly:

podman inspect --format '{{.State.Status}}' inspect-demo

Sample output:

running

Exit code (zero while running on a healthy container):

podman inspect --format '{{.State.ExitCode}}' inspect-demo

Sample output:

0

Start timestamp:

podman inspect --format '{{.State.StartedAt}}' inspect-demo

Sample output:

2026-08-23 08:09:37.005274922 +0530 IST

OOM flag:

podman inspect --format '{{.State.OOMKilled}}' inspect-demo

Sample output:

false

On a stopped container, FinishedAt and a non-zero ExitCode tell you when and how the main process ended. Pair those fields with container logs for stdout/stderr context.

Inspect restart policy

Read Podman's configured restart policy:

podman inspect --format '{{json .HostConfig.RestartPolicy}}' inspect-demo

Sample output:

{"Name":"no","MaximumRetryCount":0}

This is the container restart policy Podman stores — not systemd's Restart= on a Quadlet unit. Quadlet-managed services can restart through systemd even when the container policy is no.

Inspect health state

When a container defines a health check, State.Health reports probe status:

podman run -d --name inspect-health --health-cmd 'test -f /tmp/ok || exit 1' --health-interval 30s docker.io/library/alpine:latest sleep 3600

Read health JSON without creating the check in this article — health-check authoring is covered in the dedicated health-check guide:

podman inspect --format '{{json .State.Health}}' inspect-health

Sample output:

{"Status":"starting","FailingStreak":1,"Log":[{"Start":"2026-08-23T08:10:00.51682594+05:30","End":"2026-08-23T08:10:00.596468682+05:30","ExitCode":1,"Output":""}]}

Status moves through starting, healthy, and unhealthy as probes run. This container has no /tmp/ok file yet, so the first probe fails while status is still starting.

Inspect log path and log driver

Read the active log driver:

podman inspect --format '{{.HostConfig.LogConfig.Type}}' inspect-demo

Sample output:

journald

On this host the default driver is journald, so the file path field is empty:

podman inspect --format '{{.HostConfig.LogConfig.Path}}' inspect-demo

podman inspect --format '{{.LogPath}}' fails on Podman 5.8.2 with a template error — use HostConfig.LogConfig instead. For file-backed drivers, see View and follow container logs for path discovery and driver behavior.

Inspect an image

Full image metadata:

podman image inspect docker.io/library/nginx:alpine

Extract common fields for scripts:

podman image inspect --format '{{.Architecture}}' docker.io/library/nginx:alpine

Sample output:

amd64

Target OS family next — useful when mixing arm64 and amd64 images:

podman image inspect --format '{{.Os}}' docker.io/library/nginx:alpine

Sample output:

linux

Default runtime user baked into the image:

podman image inspect --format '{{.Config.User}}' docker.io/library/nginx:alpine

Sample output:

101

Command and entrypoint arrays:

podman image inspect --format '{{json .Config.Cmd}}' docker.io/library/nginx:alpine

Sample output:

["nginx","-g","daemon off;"]

Entrypoint runs before Cmd — nginx uses a shell wrapper script:

podman image inspect --format '{{json .Config.Entrypoint}}' docker.io/library/nginx:alpine

Sample output:

["/docker-entrypoint.sh"]

Image inspect also exposes Config.Env, Labels, and digest fields when you need them. Listing and tagging workflows stay in the image-management guides — this page is for field extraction.

Inspect a network

podman network inspect returns driver, subnets, DNS, and plugin settings. DNS enabled flag:

podman network inspect --format '{{.DNSEnabled}}' inspect-net

Sample output:

true

Subnet and gateway in one line:

podman network inspect --format '{{json .Subnets}}' inspect-net

Sample output:

[{"subnet":"10.89.1.0/24","gateway":"10.89.1.1"}]

Use these fields when debugging name resolution or confirming which CIDR a custom network owns. Creating and connecting networks is out of scope here.

Inspect a volume

Volume inspect shows driver, labels, and the host path:

podman volume inspect --format '{{.Mountpoint}}' inspect-vol

Sample output:

/var/lib/containers/storage/volumes/inspect-vol/_data

Driver name:

podman volume inspect --format '{{.Driver}}' inspect-vol

Sample output:

local

Rootful and rootless graph roots differ — always read Mountpoint from the volume you care about instead of guessing under /var/lib/containers.

Inspect a pod

Pod inspect lists infra and member containers plus shared namespaces:

podman pod inspect --format '{{.Name}}' inspect-pod

Sample output:

inspect-pod

Member container summary:

podman pod inspect --format '{{json .Containers}}' inspect-pod

Sample output (trimmed):

[{"Id":"b78124213c3a...","Name":"inspect-pod-web","State":"running"},{"Id":"ef0f72383896...","Name":"inspect-pod-infra","State":"running"}]

The infra container (*-infra) owns shared network namespace resources for the pod. Pod fundamentals and networking patterns are covered elsewhere — inspect here answers membership and state questions.

Format as JSON

Podman can emit structured JSON from --format:

podman inspect --format json inspect-demo

Sample output (trimmed):

[
     {
          "Id": "3d03aafd6603c9a7377440cabe27070bc0b4954829873ed2595a52c00fa6159e",
          "Created": "2026-08-23T08:09:36.598553277+05:30",
          ...

Plain podman inspect without --format is already JSON. Optionally pipe to jq for ad hoc queries — jq is not required for anything shown in this guide.

Inspect container filesystem size with --size

Ask Podman to calculate storage usage:

podman inspect --size --format 'rootfs={{.SizeRootFs}} writable={{.SizeRw}}' inspect-demo

Sample output:

rootfs=156192869 writable=8192

SizeRootFs is the total container root filesystem size. SizeRw is the writable upper layer only. Both fields require --size. Calculation can be slower than a plain inspect because Podman may walk storage. Use it when you need a number for capacity planning, not on every status poll.

Compare filesystem changes with podman container diff

podman container diff is separate from inspect — it compares the writable layer against the image:

podman exec inspect-demo sh -c 'echo diff-test > /tmp/inspect-diff-test'

Create a file inside the running container, then list layer changes:

podman container diff inspect-demo

Sample output:

C /etc
C /etc/nginx
C /tmp
A /tmp/inspect-diff-test
A /tmp/nginx.pid
A /tmp/client_temp
...

Line prefixes mean:

A → added
C → changed
D → deleted

Inspect tells you configuration; diff tells you which paths diverged from the image. Do not confuse the two when troubleshooting drift.

podman inspect vs dedicated inspect commands

Generic inspect is convenient at the shell. Dedicated subcommands make intent obvious in scripts and documentation.

Troubleshooting

References

• podman-inspect(1) — generic inspect and --type
• podman-container-inspect(1) — container-specific inspect
• podman-container-diff(1) — filesystem change listing
• Red Hat — Building, running, and managing containers — inspect workflows on RHEL-family systems

Summary

podman inspect is how you read Podman's stored metadata for containers, images, networks, volumes, and pods. The default JSON is complete but heavy — --format Go templates pull one field for scripts: status, image name, IP addresses, port maps, environment entries, mounts, and state timestamps.

Use --type when names collide. On Podman 5.8.2, read log settings from HostConfig.LogConfig rather than LogPath. Multi-network containers need a range template that prints each network name with its address. Image inspect exposes architecture, OS, user, command, and entrypoint without starting a container.

podman container diff complements inspect by showing filesystem drift (A, C, D lines). For published ports in plain language, pair inspect with Podman port mapping; for stdout/stderr, use container logs.