Quadlet Pod: oneshot setup container exits with status=15/TERM

[nbspsemicolon]

podman v5.5.0 / systemd 257.5-6.fc42 / fcos 42.20250526.3.0

Forgive me if this topic has already been asked. Magic search terms are magic.

Scenario: An app has multiple containers in a quad pod, the first of which handles instance config/db migrations/etc and needs a clean exit for After= to trigger in long-running services. In docker-compose, this is handled by:

services:
  app_container:
    depends_on:
      setup_container:
        condition: service_completed_successfully

Based on vanilla systemd knowledge and from what I've read on this subject, the setup_container should be achievable through a pod quad using a simple setup like this:

quadlet files

# exittest.pod
[Pod]
PodName=exittest
ServiceName=exittest

#exittest-setup.container
[Service]
Type=oneshot
RemainAfterExit=yes

[Container]
ContainerName=exittest-setup
ServiceName=exittest-setup

Pod=exittest.pod
StartWithPod=true

Image=docker.io/alpine:3
Pull=missing
Exec=sh -c "echo 'setup starting.'; sleep 2; echo 'setup complete.'; exit 0"

#exittest-app.container
[Unit]
Requires=exittest-setup.container
After=exittest-setup.container

[Container]
ContainerName=exittest-app
ServiceName=exittest-app

Pod=exittest.pod
StartWithPod=true

Image=docker.io/alpine:3
Pull=missing
Exec=sh -c "echo 'app running.'; sleep 60"

However, what I'm seeing is that as soon as the setup container finishes, everything is destroyed before the exit status can be reaped and a generic 15/TERM signal is returned, regardless of whether the internal container task succeeds or fails:

exittest-setup journal snippet

Jun 17 14:16:55 host systemd[1]: Starting exittest-setup.service...
Jun 17 14:16:55 host podman[188163]: 2025-06-17 14:16:55.720794187 -0400 EDT m=+0.049663646 container create dac20206... (image=docker.io/library/alpine:3, name=exittest-setup, pod_id=e451bf9b..., PODMAN_SYSTEMD_UNIT=exittest-setup.service)
Jun 17 14:16:55 host podman[188163]: 2025-06-17 14:16:55.768828155 -0400 EDT m=+0.097697618 container init dac20206... (image=docker.io/library/alpine:3, name=exittest-setup, pod_id=e451bf9b..., PODMAN_SYSTEMD_UNIT=exittest-setup.service)
Jun 17 14:16:55 host podman[188163]: 2025-06-17 14:16:55.771259505 -0400 EDT m=+0.100128964 container start dac20206... (image=docker.io/library/alpine:3, name=exittest-setup, pod_id=e451bf9b..., PODMAN_SYSTEMD_UNIT=exittest-setup.service)
Jun 17 14:16:55 host exittest-setup[188177]: setup starting.
Jun 17 14:16:55 host exittest-setup[188163]: setup starting.
Jun 17 14:16:55 host podman[188163]: 2025-06-17 14:16:55.774842519 -0400 EDT m=+0.103711979 container attach dac20206... (image=docker.io/library/alpine:3, name=exittest-setup, pod_id=e451bf9b..., PODMAN_SYSTEMD_UNIT=exittest-setup.service)
Jun 17 14:16:55 host podman[188163]: 2025-06-17 14:16:55.696069927 -0400 EDT m=+0.024939428 image pull cea2ff43... docker.io/alpine:3
Jun 17 14:16:57 host exittest-setup[188177]: setup complete.
Jun 17 14:16:57 host exittest-setup[188163]: setup complete.
Jun 17 14:16:57 host podman[188163]: 2025-06-17 14:16:57.777393564 -0400 EDT m=+2.106263121 container died dac20206... (image=docker.io/library/alpine:3, name=exittest-setup, PODMAN_SYSTEMD_UNIT=exittest-setup.service)
Jun 17 14:16:57 host podman[188163]: 2025-06-17 14:16:57.819685215 -0400 EDT m=+2.148554674 container remove dac20206... (image=docker.io/library/alpine:3, name=exittest-setup, pod_id=e451bf9b..., PODMAN_SYSTEMD_UNIT=exittest-setup.service)
Jun 17 14:16:57 host podman[188163]: 2025-06-17 14:16:57.820907478 -0400 EDT m=+2.149776938 pod stop e451bf9b... (image=, name=exittest)
Jun 17 14:16:57 host podman[188163]: 2025-06-17 14:16:57.837338019 -0400 EDT m=+2.166207481 container died 3fe512f2... (image=, name=exittest-infra, PODMAN_SYSTEMD_UNIT=exittest.service)
Jun 17 14:16:57 host podman[188163]: 2025-06-17 14:16:57.933766218 -0400 EDT m=+2.262635678 container cleanup 3fe512f2... (image=, name=exittest-infra, pod_id=e451bf9b..., PODMAN_SYSTEMD_UNIT=exittest.service)
Jun 17 14:16:57 host podman[188163]: 2025-06-17 14:16:57.941289681 -0400 EDT m=+2.270159141 pod stop e451bf9b... (image=, name=exittest)
Jun 17 14:16:57 host exittest-setup[188163]: time="2025-06-17T14:16:57-04:00" level=error msg="forwarding signal 15 to container dac20206...: container has already been removed"
Jun 17 14:16:57 host systemd[1]: exittest-setup.service: Main process exited, code=killed, status=15/TERM
Jun 17 14:16:57 host systemd[1]: exittest-setup.service: Failed with result 'signal'.
Jun 17 14:16:57 host systemd[1]: Stopped exittest-setup.service.

Is there anything I'm missing to get it to exit cleanly and proceed to the second long-running container?

[nbspsemicolon]

Solution

There is a misleading statement in the podman-pod-create documentation. Right now it reads as follows:

--exit-policy=continue | stop
Set the exit policy of the pod when the last container exits. Supported policies are:

Exit Policy	Description
continue	The pod continues running, by keeping its infra container alive, when the last container exits. Used by default.
stop	The pod (including its infra container) is stopped when the last container exits. Used in kube play.

I highlighted the last bit because quadlets also seem to follow this rule instead of the default. Fixing the above exittest.pod file as follows fixes this issue:

# exittest.pod
[Pod]
PodName=exittest
ServiceName=exittest

PodmanArgs=--exit-policy=continue

The last line is necessary to override the generator from trying to insert --exit-policy=stop.

[Luap99]

yes see #25596

In general we likely need some for of "oneshot" container functionally in pods.

[nbspsemicolon]

Do you think modifying quadlet.go to remove this line, promote it KeyExitPolicy, and mapping it in with lookupAndAddString is the best way to go about initial effort?

At least it exposes it and then commentary can be put in the podman-systemd.unit(5) doc

[Luap99]

yeah I think we can expose this as native quadlet option and then have a clear place to document it. Default should stay stop of course for quadlet.

[nbspsemicolon]

Ok, I'll prep a PR for it.