Docker vs Podman in 2026: The Benchmarks Contradict Each Other. Here Is How to Decide.

You are setting up a new Linux server in 2026 and you have to pick a container engine. You search for benchmarks. One writeup says Podman starts containers 34 percent faster. Another says Docker wins cold starts. A third says the whole question is pointless because runtime performance is identical.

All three are telling the truth. I compared four independent benchmark writeups published this year, and they genuinely disagree, because they tested different modes on different hardware. That disagreement is not noise. It maps exactly onto the few decisions that actually matter, and once you see the map, picking between Docker and Podman takes about five minutes.

Here is the breakdown, source by source, and the decision checklist I would keep pinned for every new server.

The 30-Second Architecture Difference

Everything in the benchmark disagreement traces back to one architectural split.

Docker is a daemon. Your CLI talks to dockerd, a long-running background process that owns every container on the host. If the daemon dies, container management dies with it. Anything that can write to /var/run/docker.sock effectively has root on the host, because the daemon will mount any path you ask into a container.

Podman has no daemon. Each podman command forks the container directly. Containers are children of your shell session or a systemd unit, not of a central privileged process. Rootless mode is the default, not an opt-in hardening exercise.

Both run the same OCI containers and images. A Compose file written for Docker works with Podman's compose command. Your images are portable in both directions. So this is not a lock-in decision. It is a defaults decision, and defaults show up in benchmarks in specific, predictable places.

Source 1: Luca Berton's Rootful vs Rootless Benchmarks

The most useful thing about Berton's 2026 writeup is that it separates rootful from rootless, which most comparisons skip.

• Cold start, rootful: about 0.30 seconds per container for Docker, 0.35 for Podman, measured across 100 sequential starts.
• Cold start, rootless: about 0.42 and 0.45 seconds. Rootless adds roughly 25 to 30 percent startup overhead for both engines, because unprivileged containers do more setup work.
• Network throughput: rootful bridge networking hits around 40 Gbps. Rootless with the older slirp4netns backend collapses to about 3 Gbps. Rootless with the pasta backend recovers to about 15 Gbps.
• I/O: rootless uses fuse-overlayfs instead of kernel overlay2, dropping a 1 GB sequential write from roughly 800 to 600 MB/s. Volume mounts bypass the overlay entirely and erase the gap.

The takeaway from this source is not "Podman is slower." It is that rootless networking backend choice matters more than engine choice. pasta is the default in Podman 4.0 and later. Docker's rootless mode still defaults to slirp4netns, which is up to 13 times slower per these numbers.

Source 2: Leaper.dev's Same-Hardware Comparison

Leaper.dev ran Docker Engine 27.x against Podman 5.4 on the same Ryzen 9 7950X machine, ten runs per test, reporting medians. This is where the contradiction with source 1 appears.

• Cold start (alpine): Docker 0.31s, Podman 0.28s. Podman faster here, slightly.
• Image build (multi-stage Node.js): Docker 38.2s, Podman 40.7s. BuildKit's parallel layer construction still wins builds.
• Network throughput: Docker 42.1 Gbps, Podman 38.7 Gbps. Note both numbers are far above the rootless figures from source 1, because this test ran in rootful-like conditions.
• 50-container parallel startup: Podman 3.6s vs Docker 4.1s.
• Runtime performance: effectively a tie. nginx served 89,200 requests per second under Docker versus 84,500 under Podman, a gap small enough to disappear under normal load variance.

Both engines use the same kernel namespaces and cgroups. Once a container is running, the engine mostly gets out of the way.

Source 3: Tech-Insider's Three-Platform Test

Tech-insider's comparison is the most aggressive pro-Podman data point, and it hinges on one number nobody else measured the same way.

• Cold start (alpine 3.20): Podman 5.4 at 0.81s versus Docker 27.x at 1.23s, a 34 percent Podman win across 50 averaged iterations.
• Idle memory: Podman uses 0 MB when no containers run. Docker's daemon holds a persistent 140 to 180 MB.
• 30-container steady state: about 2.55 GB for Podman versus 3.0 GB plus the daemon overhead for Docker. Across a 100-node fleet, that is roughly 14 GB of reclaimed RAM before workloads start.
• API latency: Docker wins this one, 21 ms versus 32 ms for listing 100 containers, because a warm daemon caches metadata a fork-exec model has to gather fresh.
• Builds: BuildKit beat Buildah by 10 to 11 percent on every multi-stage Dockerfile tested.
• Adoption gap: the CNCF 2025 survey puts Docker at about 78 percent of surveyed organizations versus 17 percent for Podman.

Notice that source 2 measured alpine cold starts at around 0.3 seconds for both, and source 3 measured 0.8 to 1.2 seconds. Different hardware, different image caching states, different iteration counts. When two benchmarks disagree by a factor of three on absolute numbers but by only a few percent on relative ordering, trust the relative ordering, and treat every absolute second as hardware-specific.

Source 4: The Security Numbers

Techplained's breakdown and a 2026 Dev.to analysis add the capability numbers that matter more than any throughput figure.

• Kernel capabilities: a rootless Podman container gets 11 kernel capabilities. Docker's default gives 14. That is least-privilege applied at the runtime level.
• Container escape outcome: escape from a rootless Podman container lands an attacker in your unprivileged user account. Escape from a rootful Docker container gives them root on the host. Still bad either way, but one is a cleanup and the other is an incident response.
• Daemon socket exposure: /var/run/docker.sock is root-equivalent. The CIS Docker Benchmark explicitly warns about it and recommends auditing docker group membership monthly. Podman has no daemon, so this attack surface does not exist.
• CVE track record: one source counted 4 critical Docker Engine CVEs versus 1 for Podman across 2023 to 2026, with 2 daemon-related container escapes for Docker and none for Podman. Treat these counts with caution, since market share skews vulnerability discovery toward the more popular tool, but the daemon-escape class is structural, not statistical.

Here is the important nuance: Docker rootless mode closes most of this gap. It exists, it works, and it uses the same RootlessKit project Podman builds on. The difference is that rootless Docker is an opt-in mode with slirp4netns networking defaults, while rootless Podman is the default path the maintainers test hardest.

So Which Benchmarks Should You Believe?

All of them, for different questions. Reading the four sources together produces a pattern cleaner than any single writeup:

• When Docker wins: image builds (BuildKit, consistently 6 to 11 percent faster), API latency on daemon-heavy workflows, raw rootful network throughput, and anything that depends on ecosystem polish.
• When Podman wins: idle memory, cold starts, parallel container startup, rootless network performance (pasta loses 5 to 8 percent versus Docker rootless slirp4netns losing around 30 percent per the Berton numbers), and security defaults.
• When it is a tie: steady-state runtime performance. CPU, sysbench, Redis operations, request throughput. Same kernel, same result.

If one article told you a single winner, it tested one mode on one workload and generalized. The honest answer is that this is two tools whose defaults optimize for different risk appetites.

The Decision Checklist

Keep this for your next server setup decision:

• Linux production server, internet-facing: Podman. Rootless by default, no root-equivalent socket, native systemd integration via Quadlet files, and pasta networking that keeps rootless throughput within 5 to 8 percent of rootful.
• CI/CD runners in unprivileged environments: Podman. No daemon means no Docker-in-Docker hacks, and rootless builds remove a supply-chain attack surface that has caused real incidents.
• macOS or Windows developer laptop: Docker Desktop. It remains more polished than Podman Machine, and the 140 MB daemon costs you nothing that matters on a dev machine.
• Team heavily invested in Compose, Docker Scout, or Testcontainers: Docker. The migration cost is small technically but real socially, and Compose edge cases still lag on Podman.
• Rootless networking under load: whichever engine you pick, verify the backend. pasta for Podman is default since 4.0. For rootless Docker, slirp4netns at roughly 3 to 9 Gbps may be the bottleneck nobody told you about.
• Either engine, any mode: mount volume paths for I/O-heavy workloads instead of writing into container layers. It bypasses the overlay filesystem and erases the largest rootless performance penalty on both tools.

The One-Paragraph Version

Both engines run identical OCI containers with near-identical steady-state performance. Docker's daemon buys you BuildKit, fast API calls, and the smoothest desktop experience, at the price of a root-equivalent socket and a permanent memory footprint. Podman's daemonless, rootless-by-default design buys you a smaller blast radius and better unprivileged performance, at the price of slower builds and a thinner ecosystem. On a Linux server that talks to the internet, the security defaults are worth more than 6 percent of build speed. On your laptop, they are not. That is the whole decision.

I write about developer tools, infrastructure, and AI engineering every week. If that is useful to you, subscribe, it is free.

Which engine is running your production servers right now, and did rootless mode survive contact with your networking requirements? I am curious whether your experience matches the benchmarks or contradicts them.