From ddcb09924f89ecd839a037800a5b15bdcfa97c20 Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Wed, 23 Sep 2026 19:29:40 +0200
Subject: [PATCH 1/9] podman: 5.8.9 -> 6.1.4

---
 nixos/modules/virtualisation/containers.nix   | 263 +++++++++---------
 .../modules/virtualisation/podman/default.nix |  25 +-
 pkgs/by-name/po/podman/package.nix            |  16 +-
 3 files changed, 149 insertions(+), 155 deletions(-)

diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index 4b0c59846d2c9..a949639b3c677 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -9,21 +9,65 @@ let
 
   inherit (lib) literalExpression mkOption types;
 
-  oldRegistriesOptionsUsed = lib.any (x: x != [ ]) (
-    with cfg.registries;
-    [
-      search
-      insecure
-      block
-    ]
-  );
-
   toml = pkgs.formats.toml { };
+  json = pkgs.formats.json { };
+  mkOptions = file: {
+    rootless.settings = mkOption {
+      type = toml.type;
+      default = { };
+      description = "rootless ${file} configuration";
+    };
+    rootful.settings = mkOption {
+      type = toml.type;
+      default = { };
+      description = "rootful ${file} configuration";
+    };
+    settings = mkOption {
+      type = toml.type;
+      default = { };
+      description = "base ${file} configuration";
+    };
+  };
 in
 {
   meta = {
     teams = [ lib.teams.podman ];
   };
+  imports = [
+    (lib.mkRemovedOptionModule [
+      "virtualisation"
+      "containers"
+      "containersConf"
+      "cniPlugins"
+    ] "Podman 6.0 removed support for CNI networking.")
+    (lib.mkRemovedOptionModule
+      [
+        "virtualisation"
+        "containers"
+        "registries"
+        "search"
+      ]
+      "Podman 6.0 dropped support for the deprecated V1 registry.conf format. Migrate to virtualisation.containers.registries.settings."
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "virtualisation"
+        "containers"
+        "registries"
+        "insecure"
+      ]
+      "Podman 6.0 dropped support for the deprecated V1 registry.conf format. Migrate to virtualisation.containers.registries.settings."
+    )
+    (lib.mkRemovedOptionModule
+      [
+        "virtualisation"
+        "containers"
+        "registries"
+        "block"
+      ]
+      "Podman 6.0 dropped support for the deprecated V1 registry.conf format. Migrate to virtualisation.containers.registries.settings."
+    )
+  ];
 
   options.virtualisation.containers = {
 
@@ -41,90 +85,24 @@ in
       description = "Enable the OCI seccomp BPF hook";
     };
 
-    containersConf.settings = mkOption {
+    containersConf = mkOptions "containers.conf";
+    storage = mkOptions "storage.conf";
+
+    registries.settings = mkOption {
       type = toml.type;
       default = { };
-      description = "containers.conf configuration";
-    };
-
-    containersConf.cniPlugins = mkOption {
-      type = types.listOf types.package;
-      defaultText = literalExpression ''
-        [
-          pkgs.cni-plugins
-        ]
-      '';
-      example = literalExpression ''
-        [
-          pkgs.cniPlugins.dnsname
-        ]
-      '';
       description = ''
-        CNI plugins to install on the system.
+        registries.conf configuration.
+
+        Examine [containers-registries.conf(5)] for more information about the format.
+
+          [containers-registries.conf(5)]: https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md
       '';
     };
 
-    storage.settings = mkOption {
-      type = toml.type;
-      description = "storage.conf configuration";
-    };
-
-    registries = {
-      # TODO: remove those options in 26.11
-      search = mkOption {
-        visible = false;
-        type = types.listOf types.str;
-        default = [ ];
-        description = ''
-          List of repositories to search.
-
-          Deprecated, examine {option}`virtualisation.containers.registries.settings` instead.
-        '';
-      };
-
-      insecure = mkOption {
-        default = [ ];
-        visible = false;
-        type = types.listOf types.str;
-        description = ''
-          List of insecure repositories.
-
-          Deprecated, examine {option}`virtualisation.containers.registries.settings` instead.
-        '';
-      };
-
-      block = mkOption {
-        default = [ ];
-        visible = false;
-        type = types.listOf types.str;
-        description = ''
-          List of blocked repositories.
-
-          Deprecated, examine {option}`virtualisation.containers.registries.settings` instead.
-        '';
-      };
-
-      settings = mkOption {
-        type = toml.type;
-        default = {
-          registry = [
-            { location = "docker.io"; }
-            { location = "quay.io"; }
-          ];
-        };
-        description = ''
-          repositories.conf configuration.
-
-          Examine [containers-registries.conf(5)] for more information about the format.
-
-            [containers-registries.conf(5)]: https://github.com/containers/image/blob/main/docs/containers-registries.conf.5.md
-        '';
-      };
-    };
-
     policy = mkOption {
       default = { };
-      type = types.attrs;
+      type = json.type;
       example = literalExpression ''
         {
           default = [ { type = "insecureAcceptAnything"; } ];
@@ -144,49 +122,80 @@ in
 
   };
 
-  config = lib.mkIf cfg.enable {
-    warnings = lib.optional oldRegistriesOptionsUsed "the options virtualisation.containers.registries.search / insecure / block are deprecated. See virtualisation.containers.registries.settings instead.";
+  config =
+    let
+      dropIn =
+        name: scope: settings:
+        let
+          path = "${name}${lib.optionalString (scope != "") ".${scope}"}.conf";
+          filename = if scope == "" then "00-nixos.conf" else "10-nixos-${scope}.conf";
+        in
+        lib.optionalAttrs (settings != { }) {
+          "containers/${path}.d/${filename}".source = toml.generate path settings;
+        };
+    in
+    lib.mkIf cfg.enable {
+      assertions =
+        let
+          attr = name: default: lib.attrByPath [ "network" name ] default cfg.containersConf.settings;
+        in
+        [
+          {
+            assertion = (attr "default_rootless_network_cmd" "pasta") == "pasta";
+            message = "Podman 6.0 only supports pasta for rootless networking.";
+          }
+          {
+            assertion = (attr "firewall_driver" "nftables") != "iptables";
+            message = "Podman 6.0 no longer supports iptables as a firewall driver. Use nftables instead.";
+          }
+          {
+            assertion = (attr "network_backend" "netavark") == "netavark";
+            message = "Podman 6.0 no longer supports network backends other than netavark.";
+          }
+        ];
 
-    virtualisation.containers.registries.settings = lib.mkIf oldRegistriesOptionsUsed {
-      registries = {
-        block.registries = cfg.registries.block;
-        insecure.registries = cfg.registries.insecure;
-        search.registries = cfg.registries.search;
+      warnings =
+        lib.optional (lib.hasAttrByPath [ "storage" "graphroot" ] cfg.storage.settings) ''
+          virtualisation.containers.storage.settings.storage.graphroot now applies to both rootful and rootless podman and will likely not work as intended.
+          Use virtualisation.containers.storage.{rootful,rootless}.settings.storage.graphroot instead.
+        ''
+        ++ lib.optional (lib.hasAttrByPath [ "storage" "runroot" ] cfg.storage.settings) ''
+          virtualisation.containers.storage.settings.storage.runroot now applies to both rootful and rootless podman and will likely not work as intended.
+          Use virtualisation.containers.storage.{rootful,rootless}.settings.storage.runroot instead.
+        '';
+
+      virtualisation.containers = {
+        containersConf.settings = {
+          engine = lib.mkIf cfg.ociSeccompBpfHook.enable {
+            hooks_dir = [ config.boot.kernelPackages.oci-seccomp-bpf-hook ];
+          };
+          containers = {
+            default_sysctls = lib.mkDefault [ "net.ipv4.ping_group_range=0 0" ];
+          };
+        };
+        storage = {
+          settings.storage = {
+            driver = lib.mkDefault "overlay";
+            options.overlay.mountopt = lib.mkDefault "nodev";
+          };
+        };
       };
+
+      environment.etc = lib.mkMerge [
+        (dropIn "containers" "" cfg.containersConf.settings)
+        (dropIn "containers" "rootful" cfg.containersConf.rootful.settings)
+        (dropIn "containers" "rootless" cfg.containersConf.rootless.settings)
+        (dropIn "storage" "" cfg.storage.settings)
+        (dropIn "storage" "rootful" cfg.storage.rootful.settings)
+        (dropIn "storage" "rootless" cfg.storage.rootless.settings)
+        (dropIn "registries" "" cfg.registries.settings)
+        {
+          "containers/policy.json".source =
+            if cfg.policy != { } then
+              json.generate "policy.json" cfg.policy
+            else
+              "${pkgs.skopeo.policy}/default-policy.json";
+        }
+      ];
     };
-
-    virtualisation.containers.containersConf.cniPlugins = [ pkgs.cni-plugins ];
-
-    virtualisation.containers.containersConf.settings = {
-      network.cni_plugin_dirs = map (p: "${lib.getBin p}/bin") cfg.containersConf.cniPlugins;
-      engine = {
-        init_path = "${pkgs.catatonit}/bin/catatonit";
-      }
-      // lib.optionalAttrs cfg.ociSeccompBpfHook.enable {
-        hooks_dir = [ config.boot.kernelPackages.oci-seccomp-bpf-hook ];
-      };
-    };
-
-    virtualisation.containers.storage.settings.storage = {
-      driver = lib.mkDefault "overlay";
-      graphroot = lib.mkDefault "/var/lib/containers/storage";
-      runroot = lib.mkDefault "/run/containers/storage";
-    };
-
-    environment.etc = {
-      "containers/containers.conf".source = toml.generate "containers.conf" cfg.containersConf.settings;
-
-      "containers/storage.conf".source = toml.generate "storage.conf" cfg.storage.settings;
-
-      "containers/registries.conf".source = toml.generate "registries.conf" cfg.registries.settings;
-
-      "containers/policy.json".source =
-        if cfg.policy != { } then
-          pkgs.writeText "policy.json" (builtins.toJSON cfg.policy)
-        else
-          "${pkgs.skopeo.policy}/default-policy.json";
-    };
-
-  };
-
 }
diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 248d89af41b4e..870295b9e52b2 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -183,20 +183,7 @@ in
                 config.systemd.package # To allow systemd-based container healthchecks
               ]
               ++ lib.optional (config.boot.supportedFilesystems.zfs or false) config.boot.zfs.package;
-            extraRuntimes =
-              cfg.extraRuntimes
-              ++
-                lib.optionals
-                  (
-                    config.virtualisation.containers.containersConf.settings.network.default_rootless_network_cmd or ""
-                    == "slirp4netns"
-                  )
-                  (
-                    with pkgs;
-                    [
-                      slirp4netns
-                    ]
-                  );
+            inherit (cfg) extraRuntimes;
           };
       };
 
@@ -255,15 +242,7 @@ in
         interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
       };
 
-      virtualisation.containers = {
-        enable = true; # Enable common /etc/containers configuration
-        containersConf.settings = {
-          network = {
-            network_backend = "netavark";
-            firewall_driver = lib.mkIf config.networking.nftables.enable "nftables";
-          };
-        };
-      };
+      virtualisation.containers.enable = true;
 
       systemd.packages = [ cfg.package ];
 
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index bf72af4e7c137..985dd2ab9bae8 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -26,7 +26,6 @@
   fuse-overlayfs,
   util-linuxMinimal,
   nftables,
-  iptables,
   iproute2,
   catatonit,
   gvproxy,
@@ -38,19 +37,20 @@
   writableTmpDirAsHomeHook,
   coreutils,
   runtimeShell,
+  fetchpatch,
 }:
 let
   systemdLibs' = systemdLibs.override { withCompression = true; };
 in
 buildGoModule (finalAttrs: {
   pname = "podman";
-  version = "5.8.9";
+  version = "6.1.4";
 
   src = fetchFromGitHub {
     owner = "podman-container-tools";
     repo = "podman";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nIWwG5QyIent0vJtEm8zDQLbqfTZmD4oKMbf2N5r2wA=";
+    hash = "sha256-RTPxNoKRqFGDFEYHUwPbsNAAZqNfBXbetfphxrwn6eM=";
   };
 
   patches = [
@@ -60,6 +60,13 @@ buildGoModule (finalAttrs: {
 
     # we intentionally don't build and install the helper so we shouldn't display messages to users about it
     ./rm-podman-mac-helper-msg.patch
+    # Fix `podman completion` in the build sandbox
+    # https://github.com/podman-container-tools/podman/pull/29832
+    (fetchpatch {
+      name = "fix-podman-completion.patch";
+      url = "https://github.com/podman-container-tools/podman/commit/7cef788844bdaae01ca672a55698d40428644eb4.patch";
+      hash = "sha256-CAECXYRFyOF4aIc9qIZQceiz5vE/gFGyitjPI48IhYU=";
+    })
   ];
 
   vendorHash = null;
@@ -165,7 +172,6 @@ buildGoModule (finalAttrs: {
       lib.optionals stdenv.hostPlatform.isLinux [
         fuse-overlayfs
         util-linuxMinimal
-        iptables
         iproute2
         nftables
       ]
@@ -184,7 +190,7 @@ buildGoModule (finalAttrs: {
         ]
         ++ lib.optionals stdenv.hostPlatform.isLinux [
           aardvark-dns # dns
-          catatonit # added here for the pause image and also set in `containersConf` for `init_path`
+          catatonit # added here for the pause image
           netavark # networking
           passt # rootless networking
           conmon # runtime monitor

From e5541038e144a4ee7fb8431b947ad208b4333c24 Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Thu, 24 Sep 2026 20:58:33 +0200
Subject: [PATCH 2/9] buildah: adjust binaries required for netavark

---
 pkgs/by-name/bu/buildah/package.nix | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/bu/buildah/package.nix b/pkgs/by-name/bu/buildah/package.nix
index a26c2e156307e..c7d22caaad936 100644
--- a/pkgs/by-name/bu/buildah/package.nix
+++ b/pkgs/by-name/bu/buildah/package.nix
@@ -9,10 +9,9 @@
   runc, # Default container runtime
   crun, # Container runtime (default with cgroups v2 for podman/buildah)
   conmon, # Container runtime monitor
-  slirp4netns, # User-mode networking for unprivileged namespaces
   fuse-overlayfs, # CoW for images, much faster than default vfs
   util-linuxMinimal, # nsenter
-  iptables,
+  nftables,
   aardvark-dns,
   netavark,
   passt,
@@ -26,10 +25,9 @@ let
       runc
       crun
       conmon
-      slirp4netns
       fuse-overlayfs
       util-linuxMinimal
-      iptables
+      nftables
     ]
     ++ extraPackages
   );

From 19ee60637c9c5c4fcc009815ec374d22b4d711af Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Wed, 23 Sep 2026 19:29:40 +0200
Subject: [PATCH 3/9] netavark: 1.17.2 -> 2.1.0

---
 pkgs/by-name/ne/netavark/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ne/netavark/package.nix b/pkgs/by-name/ne/netavark/package.nix
index cdccae3398389..faae559366734 100644
--- a/pkgs/by-name/ne/netavark/package.nix
+++ b/pkgs/by-name/ne/netavark/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "netavark";
-  version = "1.17.2";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "netavark";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FdJNcHYK6Jc1dNqcUr5Ne8dv1dzlHRhcjoldiihrov8=";
+    hash = "sha256-nTmbPKTIne4iIrX5KPWTkFc+SD1Th9/sOciAzThin9M=";
   };
 
-  cargoHash = "sha256-wp/1lWc3OfNQt74m8DtpuFO/Mf07+M7numq2FMEkeGo=";
+  cargoHash = "sha256-6ZYVQVLm9b71s5FPgTSzDmscEVLE9ZxKCg+4R+0hkUk=";
 
   nativeBuildInputs = [
     installShellFiles

From 124acf345a2c625a78aa0a30d429a2e2ebe6952a Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Wed, 23 Sep 2026 19:29:40 +0200
Subject: [PATCH 4/9] nixos/tests/podman: add docker compat test

---
 nixos/tests/podman/default.nix | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/nixos/tests/podman/default.nix b/nixos/tests/podman/default.nix
index 64ca81833af9e..7862851a65ef7 100644
--- a/nixos/tests/podman/default.nix
+++ b/nixos/tests/podman/default.nix
@@ -74,6 +74,14 @@ import ../make-test-python.nix (
             isNormalUser = true;
           };
         };
+      docker_compat =
+        { pkgs, ... }:
+        {
+          virtualisation.podman = {
+            enable = true;
+            dockerCompat = true;
+          };
+        };
     };
 
     testScript = ''
@@ -90,6 +98,7 @@ import ../make-test-python.nix (
       rootless.wait_for_unit("sockets.target")
       dns.wait_for_unit("sockets.target")
       docker.wait_for_unit("sockets.target")
+      docker_compat.wait_for_unit("sockets.target")
       start_all()
 
       with subtest("Run container as root with runc"):
@@ -251,6 +260,15 @@ import ../make-test-python.nix (
           rootless.wait_until_succeeds(su_cmd("podman ps | grep quadlet"), timeout=20)
           rootless.systemctl("stop quadlet", "alice")
 
+      with subtest("Docker compat works"):
+          docker_compat.succeed("tar cv --files-from /dev/null | docker import - scratchimg")
+          docker_compat.succeed(
+            "docker run -d --name=sleeping -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin localhost/scratchimg /bin/sleep 10"
+          )
+          docker_compat.succeed("docker ps | grep sleeping")
+          docker_compat.succeed("podman ps | grep sleeping")
+          docker_compat.succeed("docker stop sleeping")
+          docker_compat.succeed("docker rm sleeping")
       # TODO: add docker-compose test
 
     '';

From 464de51c34bbe6fe6b72d7d65a1fac8cac7e4689 Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Thu, 24 Sep 2026 22:58:31 +0200
Subject: [PATCH 5/9] containers-shortnames: init at 2025.03.19

---
 .../co/containers-shortnames/package.nix      | 42 +++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 pkgs/by-name/co/containers-shortnames/package.nix

diff --git a/pkgs/by-name/co/containers-shortnames/package.nix b/pkgs/by-name/co/containers-shortnames/package.nix
new file mode 100644
index 0000000000000..fb878af94fc52
--- /dev/null
+++ b/pkgs/by-name/co/containers-shortnames/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "containers-shortnames";
+  version = "2025.03.19";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "containers";
+    repo = "shortnames";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Rq1mMZFo8Eyqxcp+SBa/zrE7OZfbjblfAGPBumjuikk=";
+  };
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm644 shortnames.conf $out/share/containers/registries.conf.d/000-shortnames.conf
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    updateScript = nix-update-script { };
+    shortnames = "${finalAttrs.finalPackage}/share/containers/registries.conf.d/000-shortnames.conf";
+  };
+
+  meta = {
+    description = "Registry alias names for shortnames to fully specified container image names";
+    homepage = "https://github.com/containers/shortnames";
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.podman ];
+    maintainers = [ lib.maintainers.marie ];
+  };
+})

From 00c50cd2197e2aa14617d7a9011424a029c4796e Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Thu, 24 Sep 2026 23:03:05 +0200
Subject: [PATCH 6/9] nixos/virtualisation/containers: add shortnames option

---
 nixos/modules/virtualisation/containers.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/nixos/modules/virtualisation/containers.nix b/nixos/modules/virtualisation/containers.nix
index a949639b3c677..41d609b6380b7 100644
--- a/nixos/modules/virtualisation/containers.nix
+++ b/nixos/modules/virtualisation/containers.nix
@@ -85,6 +85,15 @@ in
       description = "Enable the OCI seccomp BPF hook";
     };
 
+    shortnames.enable = mkOption {
+      type = types.bool;
+      default = true;
+      description = ''
+        Enable the usage of a collection of common aliases for fully qualified images.
+        See https://github.com/containers/shortnames.
+      '';
+    };
+
     containersConf = mkOptions "containers.conf";
     storage = mkOptions "storage.conf";
 
@@ -196,6 +205,9 @@ in
             else
               "${pkgs.skopeo.policy}/default-policy.json";
         }
+        (lib.mkIf cfg.shortnames.enable {
+          "containers/registries.conf.d/000-shortnames.conf".source = pkgs.containers-shortnames.shortnames;
+        })
       ];
     };
 }

From cd731290f728cc5200b5e9074d433c8f51eaab7d Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Fri, 25 Sep 2026 16:48:39 +0200
Subject: [PATCH 7/9] nixos/virtualisation/podman: refactor dns firewall
 handling

---
 .../modules/virtualisation/podman/default.nix | 48 +++++++++++++++++--
 1 file changed, 45 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/virtualisation/podman/default.nix b/nixos/modules/virtualisation/podman/default.nix
index 870295b9e52b2..203b619067e46 100644
--- a/nixos/modules/virtualisation/podman/default.nix
+++ b/nixos/modules/virtualisation/podman/default.nix
@@ -196,6 +196,28 @@ in
       '';
     };
 
+    dns = {
+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = config.networking.firewall.backend != "firewalld";
+        defaultText = lib.literalExpression ''
+          config.networking.firewall.backend != "firewalld"
+        '';
+        description = ''
+          Whether to allow DNS (port 53) from all network interfaces configured in {option}`virtualisation.podman.dns.interfaces` to aardvark-dns.
+        '';
+      };
+      interfaces = lib.mkOption {
+        type = lib.types.listOf lib.types.nonEmptyStr;
+        default = [ ];
+        description = ''
+          List of network interfaces which should have DNS (port 53) traffic allowed.
+          Auto-named interfaces (`podman0`, `podman1`, ...) are allowed by default.
+          Add custom podman networks with an explicitly set interface name here.
+        '';
+      };
+    };
+
   };
 
   config =
@@ -222,6 +244,8 @@ in
         // cfg.defaultNetwork.settings
       );
       inherit (networkConfig) dns_enabled network_interface;
+      isFirewallD = config.networking.firewall.backend == "firewalld";
+      isNftables = config.networking.firewall.backend == "nftables";
     in
     lib.mkIf cfg.enable {
       warnings = lib.optionals cfg.enableNvidia [
@@ -238,9 +262,20 @@ in
       };
 
       # containers cannot reach aardvark-dns otherwise
-      networking.firewall = lib.mkIf (config.networking.firewall.backend != "firewalld") {
-        interfaces.${network_interface}.allowedUDPPorts = lib.mkIf dns_enabled [ 53 ];
-      };
+      networking.firewall.interfaces = lib.mkIf cfg.dns.openFirewall (
+        lib.genAttrs cfg.dns.interfaces (_: {
+          allowedUDPPorts = [ 53 ];
+          allowedTCPPorts = [ 53 ];
+        })
+      );
+
+      virtualisation.podman.dns.interfaces =
+        lib.mkIf (!isFirewallD)
+          # Add `network_interface` if it doesn't match the wildcard.
+          (
+            lib.optional (dns_enabled && (!lib.hasPrefix "podman" network_interface)) network_interface
+            ++ lib.singleton (if isNftables then "podman*" else "podman+")
+          );
 
       virtualisation.containers.enable = true;
 
@@ -318,6 +353,13 @@ in
             The options virtualisation.podman.dockerSocket.enable and virtualisation.docker.enable conflict, because only one can serve the socket.
           '';
         }
+        {
+          assertion = cfg.dns.openFirewall -> !isFirewallD;
+          message = ''
+            The option `virtualisation.podman.dns.openFirewall` cannot be used with the `firewalld` firewall backend.
+            The `firewalld` backend is not affected by the DNS firewall issue the option is built for.
+          '';
+        }
       ];
     };
 }

From 97d1692abbdf70a529022e33438a67bd910fb084 Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Mon, 26 Oct 2026 12:21:37 +0100
Subject: [PATCH 8/9] nixos/tests/podman: add dns test

---
 nixos/tests/all-tests.nix          |  1 +
 nixos/tests/podman/default.nix     | 20 --------
 nixos/tests/podman/dns.nix         | 78 ++++++++++++++++++++++++++++++
 pkgs/by-name/po/podman/package.nix |  3 +-
 4 files changed, 81 insertions(+), 21 deletions(-)
 create mode 100644 nixos/tests/podman/dns.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 782908e3a6b55..535adc98e9f44 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1521,6 +1521,7 @@ in
   plotinus = runTest ./plotinus.nix;
   pocket-id = runTest ./pocket-id.nix;
   podman = handleTestOn [ "aarch64-linux" "x86_64-linux" ] ./podman/default.nix { };
+  podman-dns = runTest ./podman/dns.nix;
   podman-tls-ghostunnel = handleTestOn [
     "aarch64-linux"
     "x86_64-linux"
diff --git a/nixos/tests/podman/default.nix b/nixos/tests/podman/default.nix
index 7862851a65ef7..6000318c6e0f8 100644
--- a/nixos/tests/podman/default.nix
+++ b/nixos/tests/podman/default.nix
@@ -47,13 +47,6 @@ import ../make-test-python.nix (
             isNormalUser = true;
           };
         };
-      dns =
-        { pkgs, ... }:
-        {
-          virtualisation.podman.enable = true;
-
-          virtualisation.podman.defaultNetwork.settings.dns_enabled = true;
-        };
       docker =
         { pkgs, ... }:
         {
@@ -96,7 +89,6 @@ import ../make-test-python.nix (
       rootful.wait_for_unit("sockets.target")
       rootful_norunc.wait_for_unit("sockets.target")
       rootless.wait_for_unit("sockets.target")
-      dns.wait_for_unit("sockets.target")
       docker.wait_for_unit("sockets.target")
       docker_compat.wait_for_unit("sockets.target")
       start_all()
@@ -221,18 +213,6 @@ import ../make-test-python.nix (
           )
           rootful.succeed("podman rm journald")
 
-      with subtest("aardvark-dns"):
-          dns.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
-          dns.succeed(
-              "podman run -d --name=webserver -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${pkgs.writeTextDir "index.html" "<h1>Testing</h1>"} scratchimg ${pkgs.python3}/bin/python -m http.server 8000"
-          )
-          dns.succeed("podman ps | grep webserver")
-          dns.wait_until_succeeds(
-              "podman run --rm --name=client -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg ${pkgs.curl}/bin/curl http://webserver:8000 | grep Testing"
-          )
-          dns.succeed("podman stop webserver")
-          dns.succeed("podman rm webserver")
-
       with subtest("A podman member can use the docker cli"):
           docker.succeed(su_cmd("docker version"))
 
diff --git a/nixos/tests/podman/dns.nix b/nixos/tests/podman/dns.nix
new file mode 100644
index 0000000000000..a473030ef8ab9
--- /dev/null
+++ b/nixos/tests/podman/dns.nix
@@ -0,0 +1,78 @@
+{ pkgs, lib, ... }:
+{
+  name = "podman-dns";
+
+  meta = {
+    maintainers = lib.teams.podman.members;
+  };
+
+  nodes = {
+    dns_iptables = {
+      virtualisation.podman = {
+        enable = true;
+        defaultNetwork.settings.dns_enabled = true;
+        dns.interfaces = [ "custom" ];
+      };
+
+      networking.firewall.backend = "iptables";
+    };
+    dns_nftables = {
+      virtualisation.podman = {
+        enable = true;
+        defaultNetwork.settings.dns_enabled = true;
+        dns.interfaces = [ "custom" ];
+      };
+
+      networking.firewall.backend = "nftables";
+      networking.nftables.enable = true;
+    };
+    dns_firewalld = {
+      virtualisation.podman = {
+        enable = true;
+        defaultNetwork.settings.dns_enabled = true;
+      };
+
+      networking.firewall.backend = "firewalld";
+      services.firewalld.enable = true;
+      networking.nftables.enable = true;
+    };
+  };
+
+  testScript = ''
+    start_all()
+
+    def test_podman(node, network = None, interface = None):
+        network_arg = ""
+        if network is not None:
+            network_arg = f"--network={network}"
+            if interface is None:
+                node.succeed(f"podman network create {network}")
+            else:
+                node.succeed(f"podman network create {network} --interface-name {interface}")
+
+        node.succeed(
+            f"podman run -d {network_arg} --name=webserver -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin -w ${pkgs.writeTextDir "index.html" "<h1>Testing</h1>"} scratchimg ${pkgs.python3}/bin/python -m http.server 8000"
+        )
+        node.succeed("podman ps | grep webserver")
+        node.wait_until_succeeds(
+            f"podman run --rm {network_arg} --name=client -v /nix/store:/nix/store -v /run/current-system/sw/bin:/bin scratchimg ${pkgs.curl}/bin/curl http://webserver:8000 | grep Testing"
+        )
+        node.succeed("podman stop webserver")
+        node.succeed("podman rm webserver")
+
+        if network is not None:
+            node.succeed(f"podman network rm {network}")
+
+    for node in machines:
+        node.succeed("tar cv --files-from /dev/null | podman import - scratchimg")
+
+        with subtest(f"aardvark-dns on node {node.name} in the default network"):
+            test_podman(node, None)
+
+        with subtest(f"aardvark-dns on node {node.name} in a custom network"):
+            test_podman(node, "custom", "custom")
+
+        with subtest(f"aardvark-dns on node {node.name} in an auto-named network"):
+            test_podman(node, "auto", None)
+  '';
+}
diff --git a/pkgs/by-name/po/podman/package.nix b/pkgs/by-name/po/podman/package.nix
index 985dd2ab9bae8..8cf9df059f3ee 100644
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -158,9 +158,10 @@ buildGoModule (finalAttrs: {
 
   passthru = {
     tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
-      inherit (nixosTests) podman;
       # related modules
       inherit (nixosTests)
+        podman
+        podman-dns
         podman-tls-ghostunnel
         ;
       oci-containers-podman = nixosTests.oci-containers.podman;

From e6dfba8a8c8e5467efc80b77fde17f3e4142ef0a Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Wed, 23 Sep 2026 19:29:40 +0200
Subject: [PATCH 9/9] nixos/doc/rl-2611: document Podman 6 upgrade

---
 .../manual/release-notes/rl-2611.section.md   | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index ba0ca252488e5..02be434514029 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -229,6 +229,30 @@
   Deployments running the server and worker in the same network namespace must also set at least the worker
   `AUTHENTIK_LISTEN__HTTP` address so that the server and worker do not bind to the same address.
 
+- `podman` has been updated to Podman 6.
+  - BoltDB support was dropped. Podman has been automatically migrating to SQLite since 5.8.0 on system reboots.
+  - `iptables` support was dropped, Podman now unconditionally uses its `nftables` backend.
+    This has the side effect that DNS in custom networks no longer works for rootful containers without a corresponding firewall rule when using the `iptables` or `nftables` firewall backend.
+    The `firewalld` backend is not affected.
+    `virtualisation.podman.dns` has been introduced to allow DNS traffic configuration.
+    Network interfaces whose name starts with `podman` are allowed by default.
+    If you have custom podman networks with non-default interface names, add them to `virtualisation.podman.dns.interfaces`.
+
+  - `netavark` is now the only supported networking backend.
+  - `slirp4netns` is no longer supported for rootless networking, `pasta` is now the default and only available option.
+    Existing containers using `slirp4netns` must be migrated using `podman system migrate`.
+  - Configuration was rewritten and now follows the [UAPI.6 Configuration Files Specification](https://uapi-group.org/specifications/specs/configuration_files_specification/).
+
+    See https://github.com/podman-container-tools/podman/blob/v6.0.0/contrib/design-docs/config-file-parsing.md.
+
+    Configuration files are now split into common, rootful and rootless versions.
+    `virtualisation.containers` was updated to support the new configuration format.
+
+    Configurations which set `graphroot` or `runroot` must move these from the common configuration to the rootful config
+    because rootless podman reads this configuration now as well.
+  - Upgrading with `nixos-rebuild boot` and rebooting is recommended, to complete the BoltDB migration and drop stale iptables rules.
+  - See upstream release notes: https://github.com/podman-container-tools/podman/blob/v6.1.2/RELEASE_NOTES.md#600
+
 - `qt.platformTheme` no longer supports the `gtk2` option as GTK 2 had reached end-of-life and will be removed in Nixpkgs.
 
 - `services.paperless` has been updated to paperless-ngx 3.0, a major release; review the [upstream v3 migration guide](https://docs.paperless-ngx.com/migration-v3/) before upgrading.